- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
by Wang Tao 24 Sep '25

24 Sep '25

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v4.19.262 commit 671fee73e08ff415d36a7c16bdf238927df83884 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYQPG CVE: CVE-2022-50419 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 448a496f760664d3e2e79466aa1787e6abc922b5 ] device_add shall not be called multiple times as stated in its documentation: 'Do not call this routine or device_register() more than once for any device structure' Syzkaller reports a bug as follows [1]: ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:33! invalid opcode: 0000 [#1] PREEMPT SMP KASAN [...] Call Trace: <TASK> __list_add include/linux/list.h:69 [inline] list_add_tail include/linux/list.h:102 [inline] kobj_kset_join lib/kobject.c:164 [inline] kobject_add_internal+0x18f/0x8f0 lib/kobject.c:214 kobject_add_varg lib/kobject.c:358 [inline] kobject_add+0x150/0x1c0 lib/kobject.c:410 device_add+0x368/0x1e90 drivers/base/core.c:3452 hci_conn_add_sysfs+0x9b/0x1b0 net/bluetooth/hci_sysfs.c:53 hci_le_cis_estabilished_evt+0x57c/0xae0 net/bluetooth/hci_event.c:6799 hci_le_meta_evt+0x2b8/0x510 net/bluetooth/hci_event.c:7110 hci_event_func net/bluetooth/hci_event.c:7440 [inline] hci_event_packet+0x63d/0xfd0 net/bluetooth/hci_event.c:7495 hci_rx_work+0xae7/0x1230 net/bluetooth/hci_core.c:4007 process_one_work+0x991/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK> Link: https://syzkaller.appspot.com/bug?id=da3246e2d33afdb92d66bc166a0934c5b14640… Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Tested-by: Hawkins Jiawei <yin31149(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- net/bluetooth/hci_sysfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c index b69d88b88d2e..ccd2c377bf83 100644 --- a/net/bluetooth/hci_sysfs.c +++ b/net/bluetooth/hci_sysfs.c @@ -48,6 +48,9 @@ void hci_conn_add_sysfs(struct hci_conn *conn) BT_DBG("conn %p", conn); + if (device_is_registered(&conn->dev)) + return; + dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle); if (device_add(&conn->dev) < 0) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] sched/core: Fix potential deadlock on rq lock
by Wang Tao 24 Sep '25

24 Sep '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICY8BJ ------------------ When CPU 1 enters the nohz_full state, and the kworker on CPU 0 executes the function sched_tick_remote, holding the lock on CPU1's rq and triggering the warning WARN_ON_ONCE(delta > (u64)NSEC_PER_SEC * 3). This leads to the process of printing the warning message, where the console_sem semaphore is held. At this point, the print task on the CPU1's rq cannot acquire the console_sem and joins the wait queue, entering the UNINTERRUPTIBLE state. It waits for the console_sem to be released and then wakes up. After the task on CPU 0 releases the console_sem, it wakes up the waiting console_sem task. In try_to_wake_up, it attempts to acquire the lock on CPU1's rq again, resulting in a deadlock. The triggering scenario is as follows: CPU0 CPU1 ---- ---- sched_tick_remote WARN_ON_ONCE(delta > (u64)NSEC_PER_SEC * 3) report_bug con_write printk console_unlock do_con_write console_lock down(&console_sem) list_add_tail(&waiter.list, &sem->wait_list); up(&console_sem) wake_up_q(&wake_q) try_to_wake_up __task_rq_lock _raw_spin_lock This patch fixes the issue by deffering all printk console printing during the lock holding period. Fixes: d84b31313ef8 ("sched/isolation: Offload residual 1Hz scheduler tick") Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/sched/core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 7515d8f77194..4149f554debd 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -3148,6 +3148,7 @@ static void sched_tick_remote(struct work_struct *work) goto out_unlock; update_rq_clock(rq); + printk_deferred_enter(); delta = rq_clock_task(rq) - curr->se.exec_start; /* @@ -3155,6 +3156,7 @@ static void sched_tick_remote(struct work_struct *work) * amount of time. */ WARN_ON_ONCE(delta > (u64)NSEC_PER_SEC * 3); + printk_deferred_exit(); curr->sched_class->task_tick(rq, curr, 0); out_unlock: -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] sched/core: Fix potential deadlock on rq lock
by Wang Tao 24 Sep '25

24 Sep '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICY8BJ ------------------ When CPU 1 enters the nohz_full state, and the kworker on CPU 0 executes the function sched_tick_remote, holding the lock on CPU1's rq and triggering the warning WARN_ON_ONCE(delta > (u64)NSEC_PER_SEC * 3). This leads to the process of printing the warning message, where the console_sem semaphore is held. At this point, the print task on the CPU1's rq cannot acquire the console_sem and joins the wait queue, entering the UNINTERRUPTIBLE state. It waits for the console_sem to be released and then wakes up. After the task on CPU 0 releases the console_sem, it wakes up the waiting console_sem task. In try_to_wake_up, it attempts to acquire the lock on CPU1's rq again, resulting in a deadlock. The triggering scenario is as follows: CPU0 CPU1 ---- ---- sched_tick_remote WARN_ON_ONCE(delta > (u64)NSEC_PER_SEC * 3) report_bug con_write printk console_unlock do_con_write console_lock down(&console_sem) list_add_tail(&waiter.list, &sem->wait_list); up(&console_sem) wake_up_q(&wake_q) try_to_wake_up __task_rq_lock _raw_spin_lock This patch fixes the issue by deffering all printk console printing during the lock holding period. Fixes: d84b31313ef8 ("sched/isolation: Offload residual 1Hz scheduler tick") Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/sched/core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 7515d8f77194..4149f554debd 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -3148,6 +3148,7 @@ static void sched_tick_remote(struct work_struct *work) goto out_unlock; update_rq_clock(rq); + printk_deferred_enter(); delta = rq_clock_task(rq) - curr->se.exec_start; /* @@ -3155,6 +3156,7 @@ static void sched_tick_remote(struct work_struct *work) * amount of time. */ WARN_ON_ONCE(delta > (u64)NSEC_PER_SEC * 3); + printk_deferred_exit(); curr->sched_class->task_tick(rq, curr, 0); out_unlock: -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: hda: Fix Oops by 9.1 surround channel names
by Wang Tao 24 Sep '25

24 Sep '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v4.19.284 commit b5694aae4c2d9a288bafce7d38f122769e0428e6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYQFY CVE: CVE-2023-53400 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3b44ec8c5c44790a82f07e90db45643c762878c6 upstream. get_line_out_pfx() may trigger an Oops by overflowing the static array with more than 8 channels. This was reported for MacBookPro 12,1 with Cirrus codec. As a workaround, extend for the 9.1 channels and also fix the potential Oops by unifying the code paths accessing the same array with the proper size check. Reported-by: Olliver Schinagl <oliver(a)schinagl.nl> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/64d95eb0-dbdb-cff8-a8b1-988dc22b24cd@schinagl.nl Link: https://lore.kernel.org/r/20230516184412.24078-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- sound/pci/hda/hda_generic.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c index 2609161707a4..142570fb0ca3 100644 --- a/sound/pci/hda/hda_generic.c +++ b/sound/pci/hda/hda_generic.c @@ -1159,8 +1159,8 @@ static bool path_has_mixer(struct hda_codec *codec, int path_idx, int ctl_type) return path && path->ctls[ctl_type]; } -static const char * const channel_name[4] = { - "Front", "Surround", "CLFE", "Side" +static const char * const channel_name[] = { + "Front", "Surround", "CLFE", "Side", "Back", }; /* give some appropriate ctl name prefix for the given line out channel */ @@ -1186,7 +1186,7 @@ static const char *get_line_out_pfx(struct hda_codec *codec, int ch, /* multi-io channels */ if (ch >= cfg->line_outs) - return channel_name[ch]; + goto fixed_name; switch (cfg->line_out_type) { case AUTO_PIN_SPEAKER_OUT: @@ -1232,6 +1232,7 @@ static const char *get_line_out_pfx(struct hda_codec *codec, int ch, if (cfg->line_outs == 1 && !spec->multi_ios) return "Line Out"; + fixed_name: if (ch >= ARRAY_SIZE(channel_name)) { snd_BUG(); return "PCM"; -- 2.34.1

2 1

[PATCH OLK-5.10] VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
by Zicheng Qu 24 Sep '25

24 Sep '25

From: George Kennedy <george.kennedy(a)oracle.com> stable inclusion from stable-v5.10.240 commit d4198f67e7556b1507f14f60d81a72660e5560e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY4GZ CVE: CVE-2023-53259 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 1a726cb47fd204109c767409fa9ca15a96328f14 ] The call to get_user_pages_fast() in vmci_host_setup_notify() can return NULL context->notify_page causing a GPF. To avoid GPF check if context->notify_page == NULL and return error if so. general protection fault, probably for non-canonical address 0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0x0005088000000300- 0x0005088000000307] CPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1 Hardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014 RIP: 0010:vmci_ctx_check_signal_notify+0x91/0xe0 Call Trace: <TASK> vmci_host_unlocked_ioctl+0x362/0x1f40 __x64_sys_ioctl+0x1a1/0x230 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: a1d88436d53a ("VMCI: Fix two UVA mapping bugs") Reported-by: syzkaller <syzkaller(a)googlegroups.com> Signed-off-by: George Kennedy <george.kennedy(a)oracle.com> Reviewed-by: Vishnu Dasa <vdasa(a)vmware.com> Link: https://lore.kernel.org/r/1669666705-24012-1-git-send-email-george.kennedy@… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Stable-dep-of: 1bd6406fb5f3 ("VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_host.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c index 4a903770b8e1..cc6da9e5a542 100644 --- a/drivers/misc/vmw_vmci/vmci_host.c +++ b/drivers/misc/vmw_vmci/vmci_host.c @@ -248,6 +248,8 @@ static int vmci_host_setup_notify(struct vmci_ctx *context, context->notify_page = NULL; return VMCI_ERROR_GENERIC; } + if (context->notify_page == NULL) + return VMCI_ERROR_UNAVAILABLE; /* * Map the locked page and set up notify pointer. -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
by Zicheng Qu 24 Sep '25

24 Sep '25

From: George Kennedy <george.kennedy(a)oracle.com> mainline inclusion from mainline-v6.3-rc1 commit 1a726cb47fd204109c767409fa9ca15a96328f14 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY4GZ CVE: CVE-2023-53259 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The call to get_user_pages_fast() in vmci_host_setup_notify() can return NULL context->notify_page causing a GPF. To avoid GPF check if context->notify_page == NULL and return error if so. general protection fault, probably for non-canonical address 0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0x0005088000000300- 0x0005088000000307] CPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1 Hardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014 RIP: 0010:vmci_ctx_check_signal_notify+0x91/0xe0 Call Trace: <TASK> vmci_host_unlocked_ioctl+0x362/0x1f40 __x64_sys_ioctl+0x1a1/0x230 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: a1d88436d53a ("VMCI: Fix two UVA mapping bugs") Reported-by: syzkaller <syzkaller(a)googlegroups.com> Signed-off-by: George Kennedy <george.kennedy(a)oracle.com> Reviewed-by: Vishnu Dasa <vdasa(a)vmware.com> Link: https://lore.kernel.org/r/1669666705-24012-1-git-send-email-george.kennedy@… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/misc/vmw_vmci/vmci_host.c [Conflict due to the 3rd parameter in get_user_pages_fast, ignore this context difference.] Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_host.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c index cdd326cc9cb9..b4bf9c2ea35d 100644 --- a/drivers/misc/vmw_vmci/vmci_host.c +++ b/drivers/misc/vmw_vmci/vmci_host.c @@ -248,6 +248,8 @@ static int vmci_host_setup_notify(struct vmci_ctx *context, context->notify_page = NULL; return VMCI_ERROR_GENERIC; } + if (context->notify_page == NULL) + return VMCI_ERROR_UNAVAILABLE; /* * Map the locked page and set up notify pointer. -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] sched/fair: Don't balance task to its current running CPU
by Zicheng Qu 24 Sep '25

24 Sep '25

From: Yicong Yang <yangyicong(a)hisilicon.com> stable inclusion from stable-v4.19.291 commit a5286f4655ce2fa28f477c0b957ea7f323fe2fab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY4I1 CVE: CVE-2023-53215 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0dd37d6dd33a9c23351e6115ae8cdac7863bc7de ] We've run into the case that the balancer tries to balance a migration disabled task and trigger the warning in set_task_cpu() like below: ------------[ cut here ]------------ WARNING: CPU: 7 PID: 0 at kernel/sched/core.c:3115 set_task_cpu+0x188/0x240 Modules linked in: hclgevf xt_CHECKSUM ipt_REJECT nf_reject_ipv4 <...snip> CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G O 6.1.0-rc4+ #1 Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V5.B221.01 12/09/2021 pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : set_task_cpu+0x188/0x240 lr : load_balance+0x5d0/0xc60 sp : ffff80000803bc70 x29: ffff80000803bc70 x28: ffff004089e190e8 x27: ffff004089e19040 x26: ffff007effcabc38 x25: 0000000000000000 x24: 0000000000000001 x23: ffff80000803be84 x22: 000000000000000c x21: ffffb093e79e2a78 x20: 000000000000000c x19: ffff004089e19040 x18: 0000000000000000 x17: 0000000000001fad x16: 0000000000000030 x15: 0000000000000000 x14: 0000000000000003 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000000400 x9 : ffffb093e4cee530 x8 : 00000000fffffffe x7 : 0000000000ce168a x6 : 000000000000013e x5 : 00000000ffffffe1 x4 : 0000000000000001 x3 : 0000000000000b2a x2 : 0000000000000b2a x1 : ffffb093e6d6c510 x0 : 0000000000000001 Call trace: set_task_cpu+0x188/0x240 load_balance+0x5d0/0xc60 rebalance_domains+0x26c/0x380 _nohz_idle_balance.isra.0+0x1e0/0x370 run_rebalance_domains+0x6c/0x80 __do_softirq+0x128/0x3d8 ____do_softirq+0x18/0x24 call_on_irq_stack+0x2c/0x38 do_softirq_own_stack+0x24/0x3c __irq_exit_rcu+0xcc/0xf4 irq_exit_rcu+0x18/0x24 el1_interrupt+0x4c/0xe4 el1h_64_irq_handler+0x18/0x2c el1h_64_irq+0x74/0x78 arch_cpu_idle+0x18/0x4c default_idle_call+0x58/0x194 do_idle+0x244/0x2b0 cpu_startup_entry+0x30/0x3c secondary_start_kernel+0x14c/0x190 __secondary_switched+0xb0/0xb4 ---[ end trace 0000000000000000 ]--- Further investigation shows that the warning is superfluous, the migration disabled task is just going to be migrated to its current running CPU. This is because that on load balance if the dst_cpu is not allowed by the task, we'll re-select a new_dst_cpu as a candidate. If no task can be balanced to dst_cpu we'll try to balance the task to the new_dst_cpu instead. In this case when the migration disabled task is not on CPU it only allows to run on its current CPU, load balance will select its current CPU as new_dst_cpu and later triggers the warning above. The new_dst_cpu is chosen from the env->dst_grpmask. Currently it contains CPUs in sched_group_span() and if we have overlapped groups it's possible to run into this case. This patch makes env->dst_grpmask of group_balance_mask() which exclude any CPUs from the busiest group and solve the issue. For balancing in a domain with no overlapped groups the behaviour keeps same as before. Suggested-by: Vincent Guittot <vincent.guittot(a)linaro.org> Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Vincent Guittot <vincent.guittot(a)linaro.org> Link: https://lore.kernel.org/r/20230530082507.10444-1-yangyicong@huawei.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 87f905bfcf3e..b889e4910c26 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -9911,7 +9911,7 @@ static int load_balance(int this_cpu, struct rq *this_rq, .sd = sd, .dst_cpu = this_cpu, .dst_rq = this_rq, - .dst_grpmask = sched_group_span(sd->groups), + .dst_grpmask = group_balance_mask(sd->groups), .idle = idle, .loop_break = sched_nr_migrate_break, .cpus = cpus, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] wifi: ath9k: verify the expected usb_endpoints are present
by Yao Kai 24 Sep '25

24 Sep '25

From: Fedor Pchelkin <pchelkin(a)ispras.ru> stable inclusion from stable-v4.19.325 commit d64436af0bc3c9e579be761d7684f228fb95f3bb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY4B9 CVE: CVE-2022-50297 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 16ef02bad239f11f322df8425d302be62f0443ce ] The bug arises when a USB device claims to be an ATH9K but doesn't have the expected endpoints. (In this case there was an interrupt endpoint where the driver expected a bulk endpoint.) The kernel needs to be able to handle such devices without getting an internal error. usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 3 PID: 500 at drivers/usb/core/urb.c:493 usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493 Modules linked in: CPU: 3 PID: 500 Comm: kworker/3:2 Not tainted 5.10.135-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Workqueue: events request_firmware_work_func RIP: 0010:usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493 Call Trace: ath9k_hif_usb_alloc_rx_urbs drivers/net/wireless/ath/ath9k/hif_usb.c:908 [inline] ath9k_hif_usb_alloc_urbs+0x75e/0x1010 drivers/net/wireless/ath/ath9k/hif_usb.c:1019 ath9k_hif_usb_dev_init drivers/net/wireless/ath/ath9k/hif_usb.c:1109 [inline] ath9k_hif_usb_firmware_cb+0x142/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1242 request_firmware_work_func+0x12e/0x240 drivers/base/firmware_loader/main.c:1097 process_one_work+0x9af/0x1600 kernel/workqueue.c:2279 worker_thread+0x61d/0x12f0 kernel/workqueue.c:2425 kthread+0x3b4/0x4a0 kernel/kthread.c:313 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:299 Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Suggested-by: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Signed-off-by: Alexey Khoroshilov <khoroshilov(a)ispras.ru> Acked-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/20221008211532.74583-1-pchelkin@ispras.ru Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yao Kai <yaokai34(a)huawei.com> --- drivers/net/wireless/ath/ath9k/hif_usb.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index fb649d85b8fc..d4bab8e9e2fa 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -1271,10 +1271,24 @@ static int send_eject_command(struct usb_interface *interface) static int ath9k_hif_usb_probe(struct usb_interface *interface, const struct usb_device_id *id) { + struct usb_endpoint_descriptor *bulk_in, *bulk_out, *int_in, *int_out; struct usb_device *udev = interface_to_usbdev(interface); + struct usb_host_interface *alt; struct hif_device_usb *hif_dev; int ret = 0; + /* Verify the expected endpoints are present */ + alt = interface->cur_altsetting; + if (usb_find_common_endpoints(alt, &bulk_in, &bulk_out, &int_in, &int_out) < 0 || + usb_endpoint_num(bulk_in) != USB_WLAN_RX_PIPE || + usb_endpoint_num(bulk_out) != USB_WLAN_TX_PIPE || + usb_endpoint_num(int_in) != USB_REG_IN_PIPE || + usb_endpoint_num(int_out) != USB_REG_OUT_PIPE) { + dev_err(&udev->dev, + "ath9k_htc: Device endpoint numbers are not the expected ones\n"); + return -ENODEV; + } + if (id->driver_info == STORAGE_DEVICE) return send_eject_command(interface); -- 2.43.0

2 1

openEuler Kernel SIG双周例会
by openEuler conference 24 Sep '25

24 Sep '25

您好！ Kernel 邀请您参加 2025-09-26 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可直接回复此邮件申请，也可直接填报至会议纪要看板。）会议链接：https://meeting.huaweicloud.com:36443/#/j/981549586 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2025-09-26 14:00, The subject of the conference is openEuler Kernel SIG双周例会 Summary: 1. 进展update 2. 议题征集中（新增议题可直接回复此邮件申请，也可直接填报至会议纪要看板。） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/981549586 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
by Fanhua Li 24 Sep '25

24 Sep '25

From: Li Zetao <lizetao1(a)huawei.com> stable inclusion from stable-v4.19.276 commit fc3442247716fc426bbcf62ed65e086e48a6d44f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY4FB CVE: CVE-2022-50279 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 117dbeda22ec5ea0918254d03b540ef8b8a64d53 ] There is a global-out-of-bounds reported by KASAN: BUG: KASAN: global-out-of-bounds in _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411 CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D 6.1.0-rc8+ #144 e15588508517267d37 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), Call Trace: <TASK> ... kasan_report+0xbb/0x1c0 _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae] rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae] ... </TASK> The root cause of the problem is that the comparison order of "prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The _rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two strings from tail to head, which causes the problem. In the _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet this requirement by carefully designing the comparison order. For example, "pregulation" and "pbandwidth" are compared in order of length from small to large, first is 3 and last is 4. However, the comparison order of "prate_section" dose not obey such order requirement, therefore when "prate_section" is "HT", when comparing from tail to head, it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As mentioned above, the _rtl8812ae_eq_n_byte() has the same function as strcmp(), so just strcmp() is enough. Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely. Although it can be fixed by adjusting the comparison order of "prate_section", this may cause the value of "rate_section" to not be from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver from staging to regular tree, but also added setting txpower limit function during the driver config phase, so the problem was introduced by this commit. Fixes: 21e4b0726dc6 ("rtlwifi: rtl8821ae: Move driver from staging to regular tree") Signed-off-by: Li Zetao <lizetao1(a)huawei.com> Acked-by: Ping-Ke Shih <pkshih(a)realtek.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/20221212025812.1541311-1-lizetao1@huawei.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c [Fanhua Li: context conflict] Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- .../wireless/realtek/rtlwifi/rtl8821ae/phy.c | 52 +++++++------------ 1 file changed, 20 insertions(+), 32 deletions(-) diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c index 176deb2b53868..755ebb3149841 100644 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c @@ -1626,18 +1626,6 @@ static bool _rtl8812ae_get_integer_from_string(char *str, u8 *pint) return true; } -static bool _rtl8812ae_eq_n_byte(u8 *str1, u8 *str2, u32 num) -{ - if (num == 0) - return false; - while (num > 0) { - num--; - if (str1[num] != str2[num]) - return false; - } - return true; -} - static s8 _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(struct ieee80211_hw *hw, u8 band, u8 channel) { @@ -1686,42 +1674,42 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregul power_limit = power_limit > MAX_POWER_INDEX ? MAX_POWER_INDEX : power_limit; - if (_rtl8812ae_eq_n_byte(pregulation, (u8 *)("FCC"), 3)) + if (strcmp(pregulation, "FCC") == 0) regulation = 0; - else if (_rtl8812ae_eq_n_byte(pregulation, (u8 *)("MKK"), 3)) + else if (strcmp(pregulation, "MKK") == 0) regulation = 1; - else if (_rtl8812ae_eq_n_byte(pregulation, (u8 *)("ETSI"), 4)) + else if (strcmp(pregulation, "ETSI") == 0) regulation = 2; - else if (_rtl8812ae_eq_n_byte(pregulation, (u8 *)("WW13"), 4)) + else if (strcmp(pregulation, "WW13") == 0) regulation = 3; - if (_rtl8812ae_eq_n_byte(prate_section, (u8 *)("CCK"), 3)) + if (strcmp(prate_section, "CCK") == 0) rate_section = 0; - else if (_rtl8812ae_eq_n_byte(prate_section, (u8 *)("OFDM"), 4)) + else if (strcmp(prate_section, "OFDM") == 0) rate_section = 1; - else if (_rtl8812ae_eq_n_byte(prate_section, (u8 *)("HT"), 2) && - _rtl8812ae_eq_n_byte(prf_path, (u8 *)("1T"), 2)) + else if (strcmp(prate_section, "HT") == 0 && + strcmp(prf_path, "1T") == 0) rate_section = 2; - else if (_rtl8812ae_eq_n_byte(prate_section, (u8 *)("HT"), 2) && - _rtl8812ae_eq_n_byte(prf_path, (u8 *)("2T"), 2)) + else if (strcmp(prate_section, "HT") == 0 && + strcmp(prf_path, "2T") == 0) rate_section = 3; - else if (_rtl8812ae_eq_n_byte(prate_section, (u8 *)("VHT"), 3) && - _rtl8812ae_eq_n_byte(prf_path, (u8 *)("1T"), 2)) + else if (strcmp(prate_section, "VHT") == 0 && + strcmp(prf_path, "1T") == 0) rate_section = 4; - else if (_rtl8812ae_eq_n_byte(prate_section, (u8 *)("VHT"), 3) && - _rtl8812ae_eq_n_byte(prf_path, (u8 *)("2T"), 2)) + else if (strcmp(prate_section, "VHT") == 0 && + strcmp(prf_path, "2T") == 0) rate_section = 5; - if (_rtl8812ae_eq_n_byte(pbandwidth, (u8 *)("20M"), 3)) + if (strcmp(pbandwidth, "20M") == 0) bandwidth = 0; - else if (_rtl8812ae_eq_n_byte(pbandwidth, (u8 *)("40M"), 3)) + else if (strcmp(pbandwidth, "40M") == 0) bandwidth = 1; - else if (_rtl8812ae_eq_n_byte(pbandwidth, (u8 *)("80M"), 3)) + else if (strcmp(pbandwidth, "80M") == 0) bandwidth = 2; - else if (_rtl8812ae_eq_n_byte(pbandwidth, (u8 *)("160M"), 4)) + else if (strcmp(pbandwidth, "160M") == 0) bandwidth = 3; - if (_rtl8812ae_eq_n_byte(pband, (u8 *)("2.4G"), 4)) { + if (strcmp(pband, "2.4G") == 0) { ret = _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(hw, BAND_ON_2_4G, channel); @@ -1745,7 +1733,7 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregul regulation, bandwidth, rate_section, channel_index, rtlphy->txpwr_limit_2_4g[regulation][bandwidth] [rate_section][channel_index][RF90_PATH_A]); - } else if (_rtl8812ae_eq_n_byte(pband, (u8 *)("5G"), 2)) { + } else if (strcmp(pband, "5G") == 0) { ret = _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(hw, BAND_ON_5G, channel); -- 2.43.0

2 1

[PATCH OLK-6.6] iommu/arm-smmu-qcom: Add SM6115 MDSS compatible
by Fanhua Li 24 Sep '25

24 Sep '25

From: Alexey Klimov <alexey.klimov(a)linaro.org> stable inclusion from stable-v6.6.103 commit a11b6ee7cab87c4d75e95ac9e7443155f7cecb55 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICXMBX CVE: CVE-2025-39739 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f7fa8520f30373ce99c436c4d57c76befdacbef3 upstream. Add the SM6115 MDSS compatible to clients compatible list, as it also needs that workaround. Without this workaround, for example, QRB4210 RB2 which is based on SM4250/SM6115 generates a lot of smmu unhandled context faults during boot: arm_smmu_context_fault: 116854 callbacks suppressed arm-smmu c600000.iommu: Unhandled context fault: fsr=0x402, iova=0x5c0ec600, fsynr=0x320021, cbfrsynra=0x420, cb=5 arm-smmu c600000.iommu: FSR = 00000402 [Format=2 TF], SID=0x420 arm-smmu c600000.iommu: FSYNR0 = 00320021 [S1CBNDX=50 PNU PLVL=1] arm-smmu c600000.iommu: Unhandled context fault: fsr=0x402, iova=0x5c0d7800, fsynr=0x320021, cbfrsynra=0x420, cb=5 arm-smmu c600000.iommu: FSR = 00000402 [Format=2 TF], SID=0x420 and also failed initialisation of lontium lt9611uxc, gpu and dpu is observed: (binding MDSS components triggered by lt9611uxc have failed) ------------[ cut here ]------------ !aspace WARNING: CPU: 6 PID: 324 at drivers/gpu/drm/msm/msm_gem_vma.c:130 msm_gem_vma_init+0x150/0x18c [msm] Modules linked in: ... (long list of modules) CPU: 6 UID: 0 PID: 324 Comm: (udev-worker) Not tainted 6.15.0-03037-gaacc73ceeb8b #4 PREEMPT Hardware name: Qualcomm Technologies, Inc. QRB4210 RB2 (DT) pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : msm_gem_vma_init+0x150/0x18c [msm] lr : msm_gem_vma_init+0x150/0x18c [msm] sp : ffff80008144b280 ... Call trace: msm_gem_vma_init+0x150/0x18c [msm] (P) get_vma_locked+0xc0/0x194 [msm] msm_gem_get_and_pin_iova_range+0x4c/0xdc [msm] msm_gem_kernel_new+0x48/0x160 [msm] msm_gpu_init+0x34c/0x53c [msm] adreno_gpu_init+0x1b0/0x2d8 [msm] a6xx_gpu_init+0x1e8/0x9e0 [msm] adreno_bind+0x2b8/0x348 [msm] component_bind_all+0x100/0x230 msm_drm_bind+0x13c/0x3d0 [msm] try_to_bring_up_aggregate_device+0x164/0x1d0 __component_add+0xa4/0x174 component_add+0x14/0x20 dsi_dev_attach+0x20/0x34 [msm] dsi_host_attach+0x58/0x98 [msm] devm_mipi_dsi_attach+0x34/0x90 lt9611uxc_attach_dsi.isra.0+0x94/0x124 [lontium_lt9611uxc] lt9611uxc_probe+0x540/0x5fc [lontium_lt9611uxc] i2c_device_probe+0x148/0x2a8 really_probe+0xbc/0x2c0 __driver_probe_device+0x78/0x120 driver_probe_device+0x3c/0x154 __driver_attach+0x90/0x1a0 bus_for_each_dev+0x68/0xb8 driver_attach+0x24/0x30 bus_add_driver+0xe4/0x208 driver_register+0x68/0x124 i2c_register_driver+0x48/0xcc lt9611uxc_driver_init+0x20/0x1000 [lontium_lt9611uxc] do_one_initcall+0x60/0x1d4 do_init_module+0x54/0x1fc load_module+0x1748/0x1c8c init_module_from_file+0x74/0xa0 __arm64_sys_finit_module+0x130/0x2f8 invoke_syscall+0x48/0x104 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x2c/0x80 el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c ---[ end trace 0000000000000000 ]--- msm_dpu 5e01000.display-controller: [drm:msm_gpu_init [msm]] *ERROR* could not allocate memptrs: -22 msm_dpu 5e01000.display-controller: failed to load adreno gpu platform a400000.remoteproc:glink-edge:apr:service@7:dais: Adding to iommu group 19 msm_dpu 5e01000.display-controller: failed to bind 5900000.gpu (ops a3xx_ops [msm]): -22 msm_dpu 5e01000.display-controller: adev bind failed: -22 lt9611uxc 0-002b: failed to attach dsi to host lt9611uxc 0-002b: probe with driver lt9611uxc failed with error -22 Suggested-by: Bjorn Andersson <andersson(a)kernel.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> Fixes: 3581b7062cec ("drm/msm/disp/dpu1: add support for display on SM6115") Cc: stable(a)vger.kernel.org Signed-off-by: Alexey Klimov <alexey.klimov(a)linaro.org> Link: https://lore.kernel.org/r/20250613173238.15061-1-alexey.klimov@linaro.org Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c index e6b4bab0dde2e..3d03136697963 100644 --- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c +++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c @@ -255,6 +255,7 @@ static const struct of_device_id qcom_smmu_client_of_match[] __maybe_unused = { { .compatible = "qcom,sdm670-mdss" }, { .compatible = "qcom,sdm845-mdss" }, { .compatible = "qcom,sdm845-mss-pil" }, + { .compatible = "qcom,sm6115-mdss" }, { .compatible = "qcom,sm6350-mdss" }, { .compatible = "qcom,sm6375-mdss" }, { .compatible = "qcom,sm8150-mdss" }, -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] [Backport] Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
by Luo Gengkun 24 Sep '25

24 Sep '25

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> mainline inclusion from mainline-v6.1-rc1 commit 3124d320c22f3f4388d9ac5c8f37eaad0cefd6b1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYJ1Y CVE: CVE-2022-50374 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- syzbot is reporting NULL pointer dereference at hci_uart_tty_close() [1], for rcu_sync_enter() is called without rcu_sync_init() due to hci_uart_tty_open() ignoring percpu_init_rwsem() failure. While we are at it, fix that hci_uart_register_device() ignores percpu_init_rwsem() failure and hci_uart_unregister_device() does not call percpu_free_rwsem(). Link: https://syzkaller.appspot.com/bug?extid=576dfca25381fb6fbc5f [1] Reported-by: syzbot <syzbot+576dfca25381fb6fbc5f(a)syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Fixes: 67d2f8781b9f00d1 ("Bluetooth: hci_ldisc: Allow sleeping while proto locks are held.") Fixes: d73e172816652772 ("Bluetooth: hci_serdev: Init hci_uart proto_lock to avoid oops") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: drivers/bluetooth/hci_serdev.c [Fix the context conflict] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/bluetooth/hci_ldisc.c | 7 +++++-- drivers/bluetooth/hci_serdev.c | 9 +++++++-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c index 73ba2977350a..99b38f70ee26 100644 --- a/drivers/bluetooth/hci_ldisc.c +++ b/drivers/bluetooth/hci_ldisc.c @@ -498,6 +498,11 @@ static int hci_uart_tty_open(struct tty_struct *tty) BT_ERR("Can't allocate control structure"); return -ENFILE; } + if (percpu_init_rwsem(&hu->proto_lock)) { + BT_ERR("Can't allocate semaphore structure"); + kfree(hu); + return -ENOMEM; + } tty->disc_data = hu; hu->tty = tty; @@ -510,8 +515,6 @@ static int hci_uart_tty_open(struct tty_struct *tty) INIT_WORK(&hu->init_ready, hci_uart_init_work); INIT_WORK(&hu->write_work, hci_uart_write_work); - percpu_init_rwsem(&hu->proto_lock); - /* Flush any pending characters in the driver */ tty_driver_flush_buffer(tty); diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c index 46e20444ba19..a551597eb6b5 100644 --- a/drivers/bluetooth/hci_serdev.c +++ b/drivers/bluetooth/hci_serdev.c @@ -284,9 +284,12 @@ int hci_uart_register_device(struct hci_uart *hu, serdev_device_set_client_ops(hu->serdev, &hci_serdev_client_ops); + if (percpu_init_rwsem(&hu->proto_lock)) + return -ENOMEM; + err = serdev_device_open(hu->serdev); if (err) - return err; + goto err_rwsem; err = p->open(hu); if (err) @@ -310,7 +313,6 @@ int hci_uart_register_device(struct hci_uart *hu, INIT_WORK(&hu->init_ready, hci_uart_init_work); INIT_WORK(&hu->write_work, hci_uart_write_work); - percpu_init_rwsem(&hu->proto_lock); /* Only when vendor specific setup callback is provided, consider * the manufacturer information valid. This avoids filling in the @@ -360,6 +362,8 @@ int hci_uart_register_device(struct hci_uart *hu, p->close(hu); err_open: serdev_device_close(hu->serdev); +err_rwsem: + percpu_free_rwsem(&hu->proto_lock); return err; } EXPORT_SYMBOL_GPL(hci_uart_register_device); @@ -376,5 +380,6 @@ void hci_uart_unregister_device(struct hci_uart *hu) hu->proto->close(hu); serdev_device_close(hu->serdev); + percpu_free_rwsem(&hu->proto_lock); } EXPORT_SYMBOL_GPL(hci_uart_unregister_device); -- 2.34.1

2 1

[PATCH OLK-6.6] loop: Avoid updating block size under exclusive owner
by Zheng Qixing 24 Sep '25

24 Sep '25

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v6.17-rc1 commit 7e49538288e523427beedd26993d446afef1a6fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICWGGN CVE: CVE-2025-38709 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ Syzbot came up with a reproducer where a loop device block size is changed underneath a mounted filesystem. This causes a mismatch between the block device block size and the block size stored in the superblock causing confusion in various places such as fs/buffer.c. The particular issue triggered by syzbot was a warning in __getblk_slow() due to requested buffer size not matching block device block size. Fix the problem by getting exclusive hold of the loop device to change its block size. This fails if somebody (such as filesystem) has already an exclusive ownership of the block device and thus prevents modifying the loop device under some exclusive owner which doesn't expect it. Reported-by: syzbot+01ef7a8da81a975e1ccd(a)syzkaller.appspotmail.com Signed-off-by: Jan Kara <jack(a)suse.cz> Tested-by: syzbot+01ef7a8da81a975e1ccd(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20250711163202.19623-2-jack@suse.cz Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: drivers/block/loop.c [Context conflicts due to not merging commit 473516b36193, ae0d40ff4964, 9423c653fe61, b38c8be255e8, b03732a9c0db and 1e1a9cecfab3.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/block/loop.c | 40 +++++++++++++++++++++++++++++++--------- 1 file changed, 31 insertions(+), 9 deletions(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index bd0e138ea6b6..8318272a1947 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1469,19 +1469,36 @@ static int loop_set_dio(struct loop_device *lo, unsigned long arg) return error; } -static int loop_set_block_size(struct loop_device *lo, unsigned long arg) +static int loop_set_block_size(struct loop_device *lo, blk_mode_t mode, + struct block_device *bdev, unsigned long arg) { int err = 0; - if (lo->lo_state != Lo_bound) - return -ENXIO; + /* + * If we don't hold exclusive handle for the device, upgrade to it + * here to avoid changing device under exclusive owner. + */ + if (!(mode & BLK_OPEN_EXCL)) { + err = bd_prepare_to_claim(bdev, loop_set_block_size, NULL); + if (err) + return err; + } + + err = mutex_lock_killable(&lo->lo_mutex); + if (err) + goto abort_claim; + + if (lo->lo_state != Lo_bound) { + err = -ENXIO; + goto unlock; + } err = blk_validate_block_size(arg); if (err) - return err; + goto unlock; if (lo->lo_queue->limits.logical_block_size == arg) - return 0; + goto unlock; sync_blockdev(lo->lo_device); invalidate_bdev(lo->lo_device); @@ -1493,6 +1510,11 @@ static int loop_set_block_size(struct loop_device *lo, unsigned long arg) loop_update_dio(lo); blk_mq_unfreeze_queue(lo->lo_queue); +unlock: + mutex_unlock(&lo->lo_mutex); +abort_claim: + if (!(mode & BLK_OPEN_EXCL)) + bd_abort_claiming(bdev, loop_set_block_size); return err; } @@ -1511,9 +1533,6 @@ static int lo_simple_ioctl(struct loop_device *lo, unsigned int cmd, case LOOP_SET_DIRECT_IO: err = loop_set_dio(lo, arg); break; - case LOOP_SET_BLOCK_SIZE: - err = loop_set_block_size(lo, arg); - break; default: err = -EINVAL; } @@ -1568,9 +1587,12 @@ static int lo_ioctl(struct block_device *bdev, blk_mode_t mode, break; case LOOP_GET_STATUS64: return loop_get_status64(lo, argp); + case LOOP_SET_BLOCK_SIZE: + if (!(mode & BLK_OPEN_WRITE) && !capable(CAP_SYS_ADMIN)) + return -EPERM; + return loop_set_block_size(lo, mode, bdev, arg); case LOOP_SET_CAPACITY: case LOOP_SET_DIRECT_IO: - case LOOP_SET_BLOCK_SIZE: if (!(mode & BLK_OPEN_WRITE) && !capable(CAP_SYS_ADMIN)) return -EPERM; fallthrough; -- 2.39.2

2 1

[PATCH OLK-6.6] arm64/mpam: Update MB hardlimit and priority default value forcely
by Zeng Heng 24 Sep '25

24 Sep '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICX9YF -------------------------------- When the root group config is absent, mpam_reprogram_ris_partid() must deliver defaults setting of the hardlimit and priority explicitly. Otherwise root group would be allowed to utilize idle memory bandwidth. Fixes: ec8cf750710c ("arm64/mpam: Update QoS partition default value") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_devices.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/drivers/platform/mpam/mpam_devices.c b/drivers/platform/mpam/mpam_devices.c index 250032f58659..783f9ffb270c 100644 --- a/drivers/platform/mpam/mpam_devices.c +++ b/drivers/platform/mpam/mpam_devices.c @@ -1258,6 +1258,22 @@ static u32 mpam_cpbm_hisi_workaround(u32 cpbm, u8 cache_level) return cpbm; } +static u16 mpam_intpri_hisi_workaround(struct mpam_msc_ris *ris, u16 intpri) +{ + struct mpam_class *class = ris->comp->class; + + if (read_cpuid_implementor() != ARM_CPU_IMP_HISI) + return intpri; + + if (class->type == MPAM_CLASS_MEMORY) + return 3; + + if (class->level == 3) + return 0; + + return intpri; +} + static void mpam_reprogram_ris_partid(struct mpam_msc_ris *ris, u16 partid, struct mpam_config *cfg) { @@ -1325,7 +1341,7 @@ static void mpam_reprogram_ris_partid(struct mpam_msc_ris *ris, u16 partid, if (mpam_has_feature(mpam_feat_max_limit, cfg)) limit = cfg->max_limit; else - limit = false; + limit = true; if (limit) mpam_write_partsel_reg(msc, MBW_MAX, bwa_fract | @@ -1343,6 +1359,7 @@ static void mpam_reprogram_ris_partid(struct mpam_msc_ris *ris, u16 partid, intpri = 0; if (mpam_has_feature(mpam_feat_intpri_part, rprops)) { + intpri = mpam_intpri_hisi_workaround(ris, intpri); if (mpam_has_feature(mpam_feat_intpri_part, cfg)) pri_val |= FIELD_PREP(MPAMCFG_PRI_INTPRI, cfg->intpri); else -- 2.25.1

2 1

[PATCH OLK-5.10] scsi: target: iscsi: Fix a race condition between login_work and the login thread
by Yifan Qiao 24 Sep '25

24 Sep '25

From: Maurizio Lombardi <mlombard(a)redhat.com> mainline inclusion from mainline-v6.2-rc1 commit fec1b2fa62c162d03f5dcd7b03e3c89d3116d49f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYBVS CVE: CVE-2022-50350 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In case a malicious initiator sends some random data immediately after a login PDU; the iscsi_target_sk_data_ready() callback will schedule the login_work and, at the same time, the negotiation may end without clearing the LOGIN_FLAGS_INITIAL_PDU flag (because no additional PDU exchanges are required to complete the login). The login has been completed but the login_work function will find the LOGIN_FLAGS_INITIAL_PDU flag set and will never stop from rescheduling itself; at this point, if the initiator drops the connection, the iscsit_conn structure will be freed, login_work will dereference a released socket structure and the kernel crashes. BUG: kernel NULL pointer dereference, address: 0000000000000230 PF: supervisor write access in kernel mode PF: error_code(0x0002) - not-present page Workqueue: events iscsi_target_do_login_rx [iscsi_target_mod] RIP: 0010:_raw_read_lock_bh+0x15/0x30 Call trace: iscsi_target_do_login_rx+0x75/0x3f0 [iscsi_target_mod] process_one_work+0x1e8/0x3c0 Fix this bug by forcing login_work to stop after the login has been completed and the socket callbacks have been restored. Add a comment to clearify the return values of iscsi_target_do_login() Signed-off-by: Maurizio Lombardi <mlombard(a)redhat.com> Link: https://lore.kernel.org/r/20221115125638.102517-1-mlombard@redhat.com Reviewed-by: Mike Christie <michael.christie(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/target/iscsi/iscsi_target_nego.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c index 393156501888..23ac31753a06 100644 --- a/drivers/target/iscsi/iscsi_target_nego.c +++ b/drivers/target/iscsi/iscsi_target_nego.c @@ -976,6 +976,13 @@ static int iscsi_target_handle_csg_one(struct iscsi_conn *conn, struct iscsi_log return 0; } +/* + * RETURN VALUE: + * + * 1 = Login successful + * -1 = Login failed + * 0 = More PDU exchanges required + */ static int iscsi_target_do_login(struct iscsi_conn *conn, struct iscsi_login *login) { int pdu_count = 0; @@ -1325,12 +1332,13 @@ int iscsi_target_start_negotiation( ret = -1; if (ret < 0) { - cancel_delayed_work_sync(&conn->login_work); iscsi_target_restore_sock_callbacks(conn); iscsi_remove_failed_auth_entry(conn); } - if (ret != 0) + if (ret != 0) { + cancel_delayed_work_sync(&conn->login_work); iscsi_target_nego_release(conn); + } return ret; } -- 2.39.2

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 3838d60c6f0bda86f712fbcee935bfb42e07b8bb
by kernel test robot 24 Sep '25

24 Sep '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 3838d60c6f0bda86f712fbcee935bfb42e07b8bb !18068 net: bridge: fix soft lockup in br_multicast_query_expired() Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202509020441.cS6vg9iy-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202509231925.VzrKhKii-lkp@intel.com drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c:546:5: error: no previous prototype for function 'ps3_pci_init' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c:900:5: error: no previous prototype for function 'ps3_pci_init_complete' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c:946:6: error: no previous prototype for function 'ps3_pci_init_complete_exit' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_cli_debug.c:1060:5: error: no previous prototype for function 'ps3_dump_context_show' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_driver_log.c:41:19: error: unused function 'time_for_log' [-Werror,-Wunused-function] drivers/scsi/linkdata/ps3stor/./linux/ps3_driver_log.c:65:19: error: unused function 'time_for_file_name' [-Werror,-Wunused-function] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:160:5: error: no previous prototype for function 'ps3_dump_file_write' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:201:5: error: no previous prototype for function 'ps3_dump_file_close' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:29:5: error: no previous prototype for function 'ps3_dump_local_time' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:51:5: error: no previous prototype for function 'ps3_dump_filename_build' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/./linux/ps3_dump.c:77:5: error: no previous prototype for function 'ps3_dump_file_open' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:132:6: error: no previous prototype for function 'ps3_trigger_irq_poll' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:244:5: error: no previous prototype for function 'ps3_resp_status_convert' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:404:6: error: no previous prototype for function 'ps3_io_recv_ok_stat_inc' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:86:6: error: no previous prototype for function 'ps3_cmd_stat_content_clear' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_debug.c:884:5: error: no previous prototype for function 'ps3_dump_dir_length' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_device_manager.c:1582:5: error: no previous prototype for function 'ps3_scsi_private_init_pd' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_device_manager.c:1664:5: error: no previous prototype for function 'ps3_scsi_private_init_vd' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_device_manager_sas.c:1633:5: error: no previous prototype for function 'ps3_sas_expander_phys_refresh' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioc_adp.c:148:6: error: no previous prototype for function 'ps3_ioc_resource_prepare_hba' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioc_adp.c:37:6: error: no previous prototype for function 'ps3_ioc_resource_prepare_switch' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioc_adp.c:89:6: error: no previous prototype for function 'ps3_ioc_resource_prepare_raid' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioc_manager.c:308:5: error: no previous prototype for function 'ps3_hard_reset_to_ready' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_ioctl.c:786:6: error: no previous prototype for function 'ps3_clean_mgr_cmd' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_irq.c:22:27: error: unused variable 'PS3_INTERRUPT_CMD_DISABLE_ALL_MASK' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:23:27: error: unused variable 'PS3_INTERRUPT_CMD_ENABLE_MSIX' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:24:27: error: unused variable 'PS3_INTERRUPT_MASK_DISABLE' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:25:27: error: unused variable 'PS3_INTERRUPT_STATUS_EXIST_IRQ' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:26:27: error: unused variable 'PS3_INTERRUPT_CLEAR_IRQ' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:28:27: error: unused variable 'PS3_SSD_IOPS_MSIX_VECTORS' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_irq.c:29:27: error: unused variable 'PS3_HDD_IOPS_MSIX_VECTORS' [-Werror,-Wunused-const-variable] drivers/scsi/linkdata/ps3stor/ps3_module_para.c:610:14: error: no previous prototype for function 'ps3_cli_ver_query' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:1059:6: error: no previous prototype for function 'ps3_qos_pd_waitq_ratio_update' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2020:15: error: no previous prototype for function 'ps3_hba_qos_decision' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2041:6: error: no previous prototype for function 'ps3_hba_qos_waitq_notify' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2101:6: error: no previous prototype for function 'ps3_cmd_waitq_abort' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:212:1: error: no previous prototype for function 'ps3_qos_cmd_waitq_get' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2464:6: error: no previous prototype for function 'ps3_hba_qos_waitq_clear_all' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2828:6: error: no previous prototype for function 'ps3_hba_qos_vd_init' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:2937:6: error: no previous prototype for function 'ps3_hba_qos_vd_reset' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3024:6: error: no previous prototype for function 'ps3_hba_qos_waitq_poll' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3280:15: error: no previous prototype for function 'ps3_raid_qos_decision' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3335:6: error: no previous prototype for function 'ps3_qos_mgrq_resend' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:336:15: error: no previous prototype for function 'ps3_qos_vd_cmdword_get' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3479:6: error: no previous prototype for function 'ps3_raid_qos_waitq_notify' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:352:15: error: no previous prototype for function 'ps3_qos_exclusive_cmdword_get' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:364:15: error: no previous prototype for function 'ps3_qos_tg_decision' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:3822:15: error: no previous prototype for function 'ps3_raid_qos_waitq_abort' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:750:15: error: no previous prototype for function 'ps3_qos_all_pd_rc_get' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:877:6: error: no previous prototype for function 'ps3_pd_quota_waitq_clear_all' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_qos.c:893:6: error: no previous prototype for function 'ps3_pd_quota_waitq_clean' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1174:5: error: no previous prototype for function 'ps3_range_check_and_insert' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1232:5: error: no previous prototype for function 'ps3_r1x_hash_range_lock' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:1313:6: error: no previous prototype for function 'ps3_r1x_hash_range_unlock' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:579:5: error: no previous prototype for function 'ps3_r1x_hash_bit_check' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:679:6: error: no previous prototype for function 'ps3_r1x_conflict_queue_hash_bit_lock' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:731:5: error: no previous prototype for function 'ps3_r1x_hash_bit_lock' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_r1x_write_lock.c:989:6: error: no previous prototype for function 'ps3_r1x_hash_bit_unlock' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_rb_tree.c:155:6: error: no previous prototype for function 'rbtDelNodeDo' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:205:6: error: no previous prototype for function 'ps3_recovery_irq_queue_destroy' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:2701:6: error: no previous prototype for function 'ps3_hard_recovery_state_finish' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:364:5: error: no previous prototype for function 'ps3_recovery_state_transfer' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:73:30: error: no previous prototype for function 'ps3_recovery_context_alloc' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:83:6: error: no previous prototype for function 'ps3_recovery_context_free' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_recovery.c:89:6: error: no previous prototype for function 'ps3_recovery_context_delete' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_sas_transport.c:408:5: error: no previous prototype for function 'ps3_sas_update_phy_info' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:1111:5: error: no previous prototype for function 'ps3_wait_for_outstanding_complete' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:877:6: error: no previous prototype for function 'ps3_set_task_manager_busy' [-Werror,-Wmissing-prototypes] drivers/scsi/linkdata/ps3stor/ps3_scsih.c:1959:1: error: unused function 'ps3_scsih_dev_id_get' [-Werror,-Wunused-function] include/linux/compiler_types.h:323:38: error: call to '__compiletime_assert_183' declared with attribute error: BUILD_BUG failed mm/filemap.c:823:14: warning: no previous prototype for function '__add_to_page_cache_locked' [-Wmissing-prototypes] mm/page_alloc.c:3040:6: warning: no previous prototype for '__drain_all_pages' [-Wmissing-prototypes] mm/page_alloc.c:3040:6: warning: no previous prototype for function '__drain_all_pages' [-Wmissing-prototypes] mm/page_alloc.c:6912:6: warning: no previous prototype for '__zone_set_pageset_high_and_batch' [-Wmissing-prototypes] mm/page_alloc.c:6912:6: warning: no previous prototype for function '__zone_set_pageset_high_and_batch' [-Wmissing-prototypes] mm/slub.o: warning: objtool: kmem_cache_free()+0x434: unreachable instruction mm/slub.o: warning: objtool: kmem_cache_free()+0x4f8: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- mm-filemap.c:warning:no-previous-prototype-for-__add_to_page_cache_locked | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- arm64-randconfig-001-20250923 | `-- mm-compaction.c:warning:HPAGE_FRAG_CHECK_INTERVAL_MSEC-defined-but-not-used |-- arm64-randconfig-003-20250923 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | `-- include-linux-compiler_types.h:error:call-to-__compiletime_assert_NNN-declared-with-attribute-error:BUILD_BUG-failed |-- arm64-randconfig-004-20250923 | |-- mm-filemap.c:warning:no-previous-prototype-for-__add_to_page_cache_locked | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-allnoconfig | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-filemap.c:warning:no-previous-prototype-for-function-__add_to_page_cache_locked | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- block-bfq-cgroup.c:warning:Excess-function-parameter-blkcg-description-in-__bfq_bic_change_cgroup | |-- block-bfq-cgroup.c:warning:Function-parameter-or-member-bfqg-not-described-in-__bfq_bic_change_cgroup | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_file_name-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_log-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_HDD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CLEAR_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_ENABLE_MSIX-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_MASK_DISABLE-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_STATUS_EXIST_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_SSD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_mgrq_resend-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:error:unused-function-ps3_scsih_dev_id_get-Werror-Wunused-function | |-- mm-filemap.c:warning:no-previous-prototype-for-function-__add_to_page_cache_locked | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250923 | |-- mm-filemap.c:warning:no-previous-prototype-for-__add_to_page_cache_locked | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-buildonly-randconfig-002-20250923 | |-- block-bfq-cgroup.c:warning:Excess-function-parameter-blkcg-description-in-__bfq_bic_change_cgroup | |-- block-bfq-cgroup.c:warning:Function-parameter-or-member-bfqg-not-described-in-__bfq_bic_change_cgroup | |-- block-bfq-cgroup.c:warning:no-previous-prototype-for-bfqg_and_blkg_get | |-- mm-filemap.c:warning:no-previous-prototype-for-__add_to_page_cache_locked | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-buildonly-randconfig-003-20250923 | |-- block-bfq-cgroup.c:warning:Excess-function-parameter-blkcg-description-in-__bfq_bic_change_cgroup | |-- block-bfq-cgroup.c:warning:Function-parameter-or-member-bfqg-not-described-in-__bfq_bic_change_cgroup | |-- block-bfq-cgroup.c:warning:no-previous-prototype-for-bfqg_and_blkg_get | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- mm-filemap.c:warning:no-previous-prototype-for-__add_to_page_cache_locked | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-buildonly-randconfig-004-20250923 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-filemap.c:warning:no-previous-prototype-for-function-__add_to_page_cache_locked | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250923 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-filemap.c:warning:no-previous-prototype-for-function-__add_to_page_cache_locked | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250923 | |-- block-bfq-cgroup.c:warning:Excess-function-parameter-blkcg-description-in-__bfq_bic_change_cgroup | |-- block-bfq-cgroup.c:warning:Function-parameter-or-member-bfqg-not-described-in-__bfq_bic_change_cgroup | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-filemap.c:warning:no-previous-prototype-for-function-__add_to_page_cache_locked | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-defconfig | |-- mm-filemap.c:warning:no-previous-prototype-for-__add_to_page_cache_locked | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-randconfig-161-20250924 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-filemap.c:warning:no-previous-prototype-for-function-__add_to_page_cache_locked | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch | `-- mm-slub.o:warning:objtool:kmem_cache_free:unreachable-instruction `-- x86_64-rhel-9.4-rust |-- block-bfq-cgroup.c:warning:Excess-function-parameter-blkcg-description-in-__bfq_bic_change_cgroup |-- block-bfq-cgroup.c:warning:Function-parameter-or-member-bfqg-not-described-in-__bfq_bic_change_cgroup |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- mm-filemap.c:warning:no-previous-prototype-for-function-__add_to_page_cache_locked |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch `-- mm-slub.o:warning:objtool:kmem_cache_free:unreachable-instruction elapsed time: 754m configs tested: 16 configs skipped: 115 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-15.1.0 arm64 randconfig-001-20250923 gcc-7.5.0 arm64 randconfig-002-20250923 clang-18 arm64 randconfig-003-20250923 gcc-7.5.0 arm64 randconfig-004-20250923 gcc-11.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250923 gcc-14 x86_64 buildonly-randconfig-002-20250923 gcc-14 x86_64 buildonly-randconfig-003-20250923 gcc-14 x86_64 buildonly-randconfig-004-20250923 clang-20 x86_64 buildonly-randconfig-005-20250923 clang-20 x86_64 buildonly-randconfig-006-20250923 clang-20 x86_64 defconfig gcc-14 x86_64 rhel-9.4-rust clang-22 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION c89d2be4e5adc0610a3e58d9a318596686fd7176
by kernel test robot 24 Sep '25

24 Sep '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: c89d2be4e5adc0610a3e58d9a318596686fd7176 !18098 drivers: serial: jsm: fix some leaks in probe Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202508301637.4sfu6N2M-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202509020546.DO94LENh-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202509020919.PwhZw5yj-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202509152248.Glnloqtx-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202509160016.RjCI0LQf-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202509160041.xVp7j0qx-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202509162016.H2iGR5dg-lkp@intel.com block/.tmp_blk-mq-pci.o: warning: objtool: missing symbol for section .text crypto/.tmp_sm4_generic.o: warning: objtool: missing symbol for section .text crypto/.tmp_zstd.o: warning: objtool: missing symbol for section .init.text drivers/usb/early/../host/xhci.h:1877:9: warning: 'XHCI_ZHAOXIN_HOST' macro redefined [-Wmacro-redefined] drivers/usb/host/xhci.h:1877:9: warning: 'XHCI_ZHAOXIN_HOST' macro redefined [-Wmacro-redefined] drivers/usb/host/xhci.h:1877:9: warning: 'XHCI_ZHAOXIN_HOST' redefined mm/.tmp_ioremap.o: warning: objtool: missing symbol for section .text mm/.tmp_util.o: warning: objtool: missing symbol for section .text mm/ioremap.o: warning: objtool: missing symbol for section .text mm/khugepaged.c:1387: warning: Function parameter or member 'reliable' not described in 'collapse_shmem' mm/maccess.c:85:6: warning: no previous prototype for function '__probe_user_read' [-Wmissing-prototypes] mm/memory_hotplug.c:925:16: warning: unused variable 'start_pfn' [-Wunused-variable] mm/memory_hotplug.c:925:23: warning: unused variable 'start_pfn' [-Wunused-variable] mm/memory_hotplug.c:970:13: warning: 'rollback_node_hotadd' defined but not used [-Wunused-function] mm/page_alloc.c:3123: warning: Function parameter or member 'mt' not described in '__putback_isolated_page' mm/vmalloc.c:231:16: warning: variable 'start' set but not used [-Wunused-but-set-variable] mm/vmalloc.c:231:23: warning: variable 'start' set but not used [-Wunused-but-set-variable] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_init.c:error:no-previous-prototype-for-sss_deinit_hwdev | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_init.c:error:no-previous-prototype-for-sss_hwdev_detach | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_init.c:error:no-previous-prototype-for-sss_hwdev_shutdown | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_init.c:error:no-previous-prototype-for-sss_hwdev_stop | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_init.c:error:no-previous-prototype-for-sss_init_hwdev | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_init.c:error:variable-fault_level-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_init.c:error:variable-pcie_src-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_io_flush.c:error:no-previous-prototype-for-sss_hwdev_flush_io | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_mgmt_info.c:error:no-previous-prototype-for-sss_deinit_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_mgmt_info.c:error:no-previous-prototype-for-sss_init_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:error:no-previous-prototype-for-sss_sync_send_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:error:no-previous-prototype-for-sss_complete_adm_event | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:error:no-previous-prototype-for-sss_hwif_deinit_adm | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:error:no-previous-prototype-for-sss_hwif_init_adm | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ceq.c:error:no-previous-prototype-for-sss_ceq_intr_handle | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ceq.c:error:no-previous-prototype-for-sss_init_ceqe_desc | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq_init.c:error:no-previous-prototype-for-sss_ctrlq_flush_sync_cmd | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq_init.c:error:no-previous-prototype-for-sss_deinit_ctrlq | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq_init.c:error:no-previous-prototype-for-sss_deinit_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq_init.c:error:no-previous-prototype-for-sss_init_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq_init.c:error:no-previous-prototype-for-sss_reinit_ctrlq_ctx | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq_init.c:error:no-previous-prototype-for-sss_wait_ctrlq_stop | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_alloc_db_addr | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_chip_set_msix_auto_mask | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_chip_set_msix_state | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_free_db_addr | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_get_glb_pf_vf_offset | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_get_global_func_id | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_get_pcie_itf_id | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_get_pf_id_of_vf | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:error:no-previous-prototype-for-sss_get_ppf_id | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_irq.c:error:no-previous-prototype-for-sss_deinit_irq_info | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_irq.c:error:no-previous-prototype-for-sss_init_irq_info | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mbx_init.c:error:no-previous-prototype-for-sss_hwif_deinit_mbx | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mbx_init.c:error:no-previous-prototype-for-sss_hwif_init_mbx | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mbx_init.c:error:no-previous-prototype-for-sss_init_func_mbx_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mbx_init.c:error:no-previous-prototype-for-sss_recv_mbx_aeq_handler | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mgmt_init.c:error:no-previous-prototype-for-sss_flush_mgmt_workq | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mgmt_init.c:error:no-previous-prototype-for-sss_force_complete_all | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mgmt_init.c:error:no-previous-prototype-for-sss_mgmt_msg_aeqe_handler | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_error.c:error:no-previous-prototype-for-sss_detect_pci_error | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_global.c:error:no-previous-prototype-for-sss_attach_is_enable | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_global.c:error:no-previous-prototype-for-sss_get_uld_info | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_global.c:error:no-previous-prototype-for-sss_get_uld_names | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_global.c:error:no-previous-prototype-for-sss_init_uld_lock | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_global.c:error:no-previous-prototype-for-sss_lock_uld | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_global.c:error:no-previous-prototype-for-sss_unlock_uld | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_probe.c:error:no-previous-prototype-for-sss_attach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_probe.c:error:no-previous-prototype-for-sss_pci_probe | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_remove.c:error:no-previous-prototype-for-sss_deinit_adapter | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_remove.c:error:no-previous-prototype-for-sss_deinit_function | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_remove.c:error:no-previous-prototype-for-sss_deinit_pci_dev | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_remove.c:error:no-previous-prototype-for-sss_detach_all_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_remove.c:error:no-previous-prototype-for-sss_detach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_remove.c:error:no-previous-prototype-for-sss_dettach_uld_dev | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_remove.c:error:no-previous-prototype-for-sss_pci_remove | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_remove.c:error:no-previous-prototype-for-sss_unmap_pci_bar | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_shutdown.c:error:no-previous-prototype-for-sss_pci_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ethtool.c:error:no-previous-prototype-for-sss_nic_set_ethtool_ops | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ethtool_stats.c:error:no-previous-prototype-for-sss_nic_get_strings | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_filter.c:error:no-previous-prototype-for-sss_nic_set_rx_mode_work | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_irq.c:error:no-previous-prototype-for-sss_nic_release_qp_irq | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_irq.c:error:no-previous-prototype-for-sss_nic_request_qp_irq | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:error:no-previous-prototype-for-get_nic_uld_info | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:error:no-previous-prototype-for-sss_nic_port_module_link_err | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_netdev_ops.c:error:no-previous-prototype-for-sss_nic_set_netdev_ops | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:error:no-previous-prototype-for-sss_nic_ethtool_delete_flow | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:error:no-previous-prototype-for-sss_nic_ethtool_get_flow | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:error:no-previous-prototype-for-sss_nic_ethtool_update_flow | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:error:no-previous-prototype-for-sss_nic_flush_rx_flow_rule | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:error:no-previous-prototype-for-sss_nic_flush_tcam | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:error:no-previous-prototype-for-sss_nic_flush_tcam_list | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rx_init.c:error:no-previous-prototype-for-sss_nic_alloc_rq_res_group | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rx_init.c:error:no-previous-prototype-for-sss_nic_free_rq_desc_group | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rx_init.c:error:no-previous-prototype-for-sss_nic_free_rq_res_group | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rx_init.c:error:no-previous-prototype-for-sss_nic_init_rq_desc_group | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rx_init.c:error:no-previous-prototype-for-sss_nic_reset_rx_rss | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rx_init.c:error:no-previous-prototype-for-sss_nic_update_rx_rss | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_tx_init.c:error:no-previous-prototype-for-sss_nic_alloc_sq_resource | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_tx_init.c:error:no-previous-prototype-for-sss_nic_flush_all_sq | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_tx_init.c:error:no-previous-prototype-for-sss_nic_free_sq_desc_group | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_tx_init.c:error:no-previous-prototype-for-sss_nic_free_sq_resource | |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_tx_init.c:error:no-previous-prototype-for-sss_nic_init_all_sq | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-usb-host-xhci-mem.c:warning:minor_revision-may-be-used-uninitialized | |-- drivers-usb-host-xhci.h:warning:XHCI_ZHAOXIN_HOST-redefined | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-wait-in-((struct-list_head-)x)-.prev | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-waiter-in-(struct-list_head-)((char-)sem-).prev | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-001-20250923 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20250923 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250923 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-004-20250923 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | |-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-r121-20250728 | |-- kernel-cgroup-cgroup.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-cgroup_subsys_state-css-got-struct-cgroup_subsys_state-noderef-asn | `-- mm-page_alloc.c:sparse:sparse:invalid-assignment: |-- arm64-randconfig-r121-20250729 | |-- mm-mem_reliable.c:sparse:sparse:invalid-assignment: | |-- mm-mem_reliable.c:sparse:sparse:symbol-reliable_pagecache_max_bytes_write-was-not-declared.-Should-it-be-static | `-- mm-page_alloc.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-gfp_t-usertype-flags-got-unsigned-int |-- x86_64-allnoconfig | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-maccess.c:warning:no-previous-prototype-for-function-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-allyesconfig | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-usb-early-..-host-xhci.h:warning:XHCI_ZHAOXIN_HOST-macro-redefined | |-- drivers-usb-host-xhci.h:warning:XHCI_ZHAOXIN_HOST-macro-redefined | |-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-function-__probe_user_read | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250923 | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-function-__probe_user_read | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250923 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-usb-early-..-host-xhci.h:warning:XHCI_ZHAOXIN_HOST-macro-redefined | |-- drivers-usb-host-xhci.h:warning:XHCI_ZHAOXIN_HOST-macro-redefined | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-maccess.c:warning:no-previous-prototype-for-function-__probe_user_read | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250923 | |-- block-.tmp_blk-mq-pci.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- crypto-.tmp_sm4_generic.o:warning:objtool:missing-symbol-for-section-.text | |-- crypto-.tmp_zstd.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-usb-early-..-host-xhci.h:warning:XHCI_ZHAOXIN_HOST-macro-redefined | |-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-.tmp_util.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-function-__probe_user_read | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used `-- x86_64-rhel-9.4-rust |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- drivers-usb-early-..-host-xhci.h:warning:XHCI_ZHAOXIN_HOST-macro-redefined |-- drivers-usb-host-xhci.h:warning:XHCI_ZHAOXIN_HOST-macro-redefined |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem |-- mm-maccess.c:warning:no-previous-prototype-for-function-__probe_user_read |-- mm-memcontrol.c:warning:bad-line:otherwise. |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page |-- mm-rmap.c:warning:variable-cstart-set-but-not-used `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 730m configs tested: 16 configs skipped: 122 tested configs: arm64 allmodconfig gcc-15.1.0 arm64 allnoconfig gcc-15.1.0 arm64 randconfig-001-20250923 gcc-7.5.0 arm64 randconfig-002-20250923 gcc-15.1.0 arm64 randconfig-003-20250923 gcc-7.5.0 arm64 randconfig-004-20250923 gcc-11.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250923 gcc-14 x86_64 buildonly-randconfig-002-20250923 gcc-14 x86_64 buildonly-randconfig-003-20250923 gcc-14 x86_64 buildonly-randconfig-004-20250923 clang-20 x86_64 buildonly-randconfig-005-20250923 clang-20 x86_64 buildonly-randconfig-006-20250923 clang-20 x86_64 defconfig gcc-14 x86_64 rhel-9.4-rust clang-22 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2919/2919] drivers/net/ethernet/wangxun/txgbe/txgbe.h:987:6: warning: variable 'cur_diff' set but not used
by kernel test robot 24 Sep '25

24 Sep '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 197ce274f644770303e8a9c9591ac6cf6a7ded25 commit: 2048b5b7f264f56a4d9e73079e790e13c8596aaf [2919/2919] net: wangxun: txgbe: add support for wangxun 10G/25G/40G config: x86_64-buildonly-randconfig-005-20250923 (https://download.01.org/0day-ci/archive/20250924/202509240211.6y9LdLBP-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250924/202509240211.6y9LdLBP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509240211.6y9LdLBP-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_debugfs.c:4: >> drivers/net/ethernet/wangxun/txgbe/txgbe.h:987:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 987 | u32 cur_diff = 0; | ^ 1 warning generated. -- In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:28: In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_xsk.h:7: >> drivers/net/ethernet/wangxun/txgbe/txgbe.h:987:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 987 | u32 cur_diff = 0; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:582:7: warning: variable 'real_tx_hang' set but not used [-Wunused-but-set-variable] 582 | bool real_tx_hang = false; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:2618:21: warning: variable 'tx_ring' set but not used [-Wunused-but-set-variable] 2618 | struct txgbe_ring *tx_ring; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4403:20: warning: variable 'vlnctrl' set but not used [-Wunused-but-set-variable] 4403 | u32 fctrl, vmolr, vlnctrl; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:6709:9: warning: variable 'missed_rx' set but not used [-Wunused-but-set-variable] 6709 | u32 i, missed_rx = 0, mpc, bprc, lxon, lxoff; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:6915:6: warning: no previous prototype for function 'txgbe_irq_rearm_queues' [-Wmissing-prototypes] 6915 | void txgbe_irq_rearm_queues(struct txgbe_adapter *adapter, | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:6915:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6915 | void txgbe_irq_rearm_queues(struct txgbe_adapter *adapter, | ^ | static >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:9001:6: warning: variable 'nxmit' set but not used [-Wunused-but-set-variable] 9001 | int nxmit = 0; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:9169:5: warning: variable 'vlan_addlen' set but not used [-Wunused-but-set-variable] 9169 | u8 vlan_addlen = 0; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:11120:10: error: use of undeclared identifier 'txgbe_pm_ops' 11120 | .pm = &txgbe_pm_ops, | ^ 8 warnings and 1 error generated. -- In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_e56.c:4: In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_e56.h:8: >> drivers/net/ethernet/wangxun/txgbe/txgbe.h:987:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 987 | u32 cur_diff = 0; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_e56.c:1480:6: warning: variable 'osc_freq_err_occur' set but not used [-Wunused-but-set-variable] 1480 | int osc_freq_err_occur; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_e56.c:3438:4: warning: variable 'adapter' is uninitialized when used here [-Wuninitialized] 3438 | e_info(drv, "ERROR: Wait E56PHY_CTRL_FSM_RX_STAT_0_ADDR Timeout!!!\n"); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/wangxun/txgbe/txgbe.h:1292:30: note: expanded from macro 'e_info' 1292 | netif_info(adapter, msglvl, adapter->netdev, format, ## arg) | ^~~~~~~ include/net/net_debug.h:109:32: note: expanded from macro 'netif_info' 109 | netif_level(info, priv, type, dev, fmt, ##args) | ^~~ include/net/net_debug.h:93:18: note: expanded from macro 'netif_level' 93 | netdev_##level(dev, fmt, ##args); \ | ^~~ drivers/net/ethernet/wangxun/txgbe/txgbe_e56.c:3281:31: note: initialize the variable 'adapter' to silence this warning 3281 | struct txgbe_adapter *adapter; | ^ | = NULL 3 warnings generated. -- In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_param.c:7: >> drivers/net/ethernet/wangxun/txgbe/txgbe.h:987:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 987 | u32 cur_diff = 0; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_param.c:918:15: warning: variable 'pstring' set but not used [-Wunused-but-set-variable] 918 | const char *pstring; | ^ 2 warnings generated. -- In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_ptp.c:4: >> drivers/net/ethernet/wangxun/txgbe/txgbe.h:987:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 987 | u32 cur_diff = 0; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_ptp.c:656:2: warning: unannotated fall-through between switch labels [-Wimplicit-fallthrough] 656 | case HWTSTAMP_TX_ON: | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_ptp.c:656:2: note: insert 'break;' to avoid fall-through 656 | case HWTSTAMP_TX_ON: | ^ | break; 2 warnings generated. -- >> drivers/net/ethernet/wangxun/txgbe/txgbe_debugfs.c:23: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * data operation drivers/net/ethernet/wangxun/txgbe/txgbe_debugfs.c:190: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * reg_ops operation drivers/net/ethernet/wangxun/txgbe/txgbe_debugfs.c:330: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * netdev_ops operation >> drivers/net/ethernet/wangxun/txgbe/txgbe_debugfs.c:444: warning: Function parameter or member 'adapter' not described in 'txgbe_dbg_adapter_exit' >> drivers/net/ethernet/wangxun/txgbe/txgbe_debugfs.c:444: warning: Excess function parameter 'pf' description in 'txgbe_dbg_adapter_exit' >> drivers/net/ethernet/wangxun/txgbe/txgbe_debugfs.c:471: warning: Function parameter or member 'adapter' not described in 'txgbe_dump' -- In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c:10: In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_e56.h:8: >> drivers/net/ethernet/wangxun/txgbe/txgbe.h:987:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 987 | u32 cur_diff = 0; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c:6456:2: warning: unannotated fall-through between switch labels [-Wimplicit-fallthrough] 6456 | case 0x7F: | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c:6456:2: note: insert 'break;' to avoid fall-through 6456 | case 0x7F: | ^ | break; drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c:6468:2: warning: unannotated fall-through between switch labels [-Wimplicit-fallthrough] 6468 | case TXGBE_ATR_L4TYPE_MASK: | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c:6468:2: note: insert 'break;' to avoid fall-through 6468 | case TXGBE_ATR_L4TYPE_MASK: | ^ | break; >> drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c:7554:6: warning: variable 'status' set but not used [-Wunused-but-set-variable] 7554 | int status; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_hw.c:7687:6: warning: variable 'status' set but not used [-Wunused-but-set-variable] 7687 | int status; | ^ 5 warnings generated. -- >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:105: warning: Function parameter or member 'hw' not described in 'txgbe_get_phy_type_from_id' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:105: warning: Excess function parameter 'phy_id' description in 'txgbe_get_phy_type_from_id' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:174: warning: Function parameter or member 'device_type' not described in 'txgbe_read_phy_reg_mdi' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:174: warning: expecting prototype for txgbe_read_phy_mdi(). Prototype was for txgbe_read_phy_reg_mdi() instead >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:212: warning: Function parameter or member 'device_type' not described in 'txgbe_read_phy_reg' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:323: warning: Function parameter or member 'speed_set' not described in 'txgbe_setup_phy_link' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:323: warning: Function parameter or member 'autoneg_wait_to_complete' not described in 'txgbe_setup_phy_link' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:381: warning: Function parameter or member 'autoneg_wait_to_complete' not described in 'txgbe_setup_phy_link_speed' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:1094: warning: Function parameter or member 'sff8472_data' not described in 'txgbe_read_i2c_sff8472' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:1094: warning: Excess function parameter 'eeprom_data' description in 'txgbe_read_i2c_sff8472' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:1111: warning: Function parameter or member 'page' not described in 'txgbe_read_i2c_sff8636' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:1111: warning: Function parameter or member 'sff8636_data' not described in 'txgbe_read_i2c_sff8636' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:1111: warning: Excess function parameter 'eeprom_data' description in 'txgbe_read_i2c_sff8636' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:1133: warning: Function parameter or member 'data' not described in 'txgbe_read_i2c_sfp_phy' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:1133: warning: Excess function parameter 'eeprom_data' description in 'txgbe_read_i2c_sfp_phy' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:1170: warning: Function parameter or member 'dev_addr' not described in 'txgbe_read_i2c_byte_int' drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:1211: warning: Function parameter or member 'dev_addr' not described in 'txgbe_read_i2c_word_int' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:1326: warning: Function parameter or member 'dev_addr' not described in 'txgbe_read_i2c_byte' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:1344: warning: Function parameter or member 'dev_addr' not described in 'txgbe_read_i2c_word' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:1363: warning: Function parameter or member 'dev_addr' not described in 'txgbe_write_i2c_byte_int' >> drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:1363: warning: Excess function parameter 'lock' description in 'txgbe_write_i2c_byte_int' drivers/net/ethernet/wangxun/txgbe/txgbe_phy.c:1396: warning: Function parameter or member 'dev_addr' not described in 'txgbe_write_i2c_byte' -- >> drivers/net/ethernet/wangxun/txgbe/txgbe_lib.c:765: warning: Function parameter or member 'xdp_count' not described in 'txgbe_alloc_q_vector' >> drivers/net/ethernet/wangxun/txgbe/txgbe_lib.c:765: warning: Function parameter or member 'xdp_idx' not described in 'txgbe_alloc_q_vector' -- >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:51: warning: Function parameter or member 'hw' not described in 'txgbe_dcb_calculate_tc_credits_cee' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:51: warning: Function parameter or member 'dcb_config' not described in 'txgbe_dcb_calculate_tc_credits_cee' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:51: warning: Function parameter or member 'max_frame_size' not described in 'txgbe_dcb_calculate_tc_credits_cee' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:51: warning: Excess function parameter 'txgbe_dcb_config' description in 'txgbe_dcb_calculate_tc_credits_cee' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:249: warning: Function parameter or member 'dcb_config' not described in 'txgbe_dcb_config_tc_stats' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:387: warning: Function parameter or member 'refill' not described in 'txgbe_dcb_config_rx_arbiter' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:387: warning: Function parameter or member 'max' not described in 'txgbe_dcb_config_rx_arbiter' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:387: warning: Function parameter or member 'bwg_id' not described in 'txgbe_dcb_config_rx_arbiter' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:387: warning: Function parameter or member 'tsa' not described in 'txgbe_dcb_config_rx_arbiter' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:387: warning: Function parameter or member 'map' not described in 'txgbe_dcb_config_rx_arbiter' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:387: warning: Excess function parameter 'dcb_config' description in 'txgbe_dcb_config_rx_arbiter' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:444: warning: Function parameter or member 'refill' not described in 'txgbe_dcb_config_tx_desc_arbiter' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:444: warning: Function parameter or member 'max' not described in 'txgbe_dcb_config_tx_desc_arbiter' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:444: warning: Function parameter or member 'bwg_id' not described in 'txgbe_dcb_config_tx_desc_arbiter' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:444: warning: Function parameter or member 'tsa' not described in 'txgbe_dcb_config_tx_desc_arbiter' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:444: warning: Excess function parameter 'dcb_config' description in 'txgbe_dcb_config_tx_desc_arbiter' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:487: warning: Function parameter or member 'refill' not described in 'txgbe_dcb_config_tx_data_arbiter' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:487: warning: Function parameter or member 'max' not described in 'txgbe_dcb_config_tx_data_arbiter' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:487: warning: Function parameter or member 'bwg_id' not described in 'txgbe_dcb_config_tx_data_arbiter' >> drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:487: warning: Function parameter or member 'tsa' not described in 'txgbe_dcb_config_tx_data_arbiter' drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:487: warning: Function parameter or member 'map' not described in 'txgbe_dcb_config_tx_data_arbiter' drivers/net/ethernet/wangxun/txgbe/txgbe_dcb.c:487: warning: Excess function parameter 'dcb_config' description in 'txgbe_dcb_config_tx_data_arbiter' -- >> drivers/net/ethernet/wangxun/txgbe/txgbe_ptp.c:153: warning: Function parameter or member 'timestamp' not described in 'txgbe_ptp_convert_to_hwtstamp' >> drivers/net/ethernet/wangxun/txgbe/txgbe_ptp.c:153: warning: Excess function parameter 'systim' description in 'txgbe_ptp_convert_to_hwtstamp' >> drivers/net/ethernet/wangxun/txgbe/txgbe_ptp.c:353: warning: Excess function parameter 'eicr' description in 'txgbe_ptp_check_pps_event' >> drivers/net/ethernet/wangxun/txgbe/txgbe_ptp.c:579: warning: Function parameter or member 'adapter' not described in 'txgbe_ptp_rx_hwtstamp' >> drivers/net/ethernet/wangxun/txgbe/txgbe_ptp.c:579: warning: expecting prototype for txgbe_ptp_rx_rgtstamp(). Prototype was for txgbe_ptp_rx_hwtstamp() instead >> drivers/net/ethernet/wangxun/txgbe/txgbe_ptp.c:607: warning: Function parameter or member 'ifr' not described in 'txgbe_ptp_get_ts_config' >> drivers/net/ethernet/wangxun/txgbe/txgbe_ptp.c:607: warning: Excess function parameter 'ifreq' description in 'txgbe_ptp_get_ts_config' >> drivers/net/ethernet/wangxun/txgbe/txgbe_ptp.c:755: warning: Function parameter or member 'ifr' not described in 'txgbe_ptp_set_ts_config' >> drivers/net/ethernet/wangxun/txgbe/txgbe_ptp.c:755: warning: Excess function parameter 'ifreq' description in 'txgbe_ptp_set_ts_config' .. vim +/cur_diff +987 drivers/net/ethernet/wangxun/txgbe/txgbe.h 982 983 static inline u32 txgbe_misc_isb(struct txgbe_adapter *adapter, 984 enum txgbe_isb_idx idx) 985 { 986 u32 cur_tag = 0; > 987 u32 cur_diff = 0; 988 989 cur_tag = adapter->isb_mem[TXGBE_ISB_HEADER]; 990 cur_diff = cur_tag - adapter->isb_tag[idx]; 991 992 adapter->isb_tag[idx] = cur_tag; 993 994 return adapter->isb_mem[idx]; 995 } 996 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2909/2909] include/../drivers/pci/msi/msi.h:113:57: warning: declaration of 'struct msix_entry' will not be visible outside of this function
by kernel test robot 23 Sep '25

23 Sep '25

Hi yangxiangkai, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f188c8019eb561258fec0741574f196e013c7fa6 commit: ad540a13eb8292fc92651b3bf281088a502a85f9 [2909/2909] virtcca feature: fix msi iova map config: arm64-randconfig-r121-20250923 (https://download.01.org/0day-ci/archive/20250923/202509232154.ZKw00IX1-lkp@…) compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250923/202509232154.ZKw00IX1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509232154.ZKw00IX1-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/coda/coda_pci.c:8: >> include/../drivers/pci/msi/msi.h:113:57: warning: declaration of 'struct msix_entry' will not be visible outside of this function [-Wvisibility] int __pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries, int minvec, ^ 1 warning generated. vim +113 include/../drivers/pci/msi/msi.h 897a0b6aa8c7ee Ahmed S. Darwish 2022-11-11 107 b12d0bec385b7a Ahmed S. Darwish 2022-11-11 108 /* MSI internal functions invoked from the public APIs */ b12d0bec385b7a Ahmed S. Darwish 2022-11-11 109 void pci_msi_shutdown(struct pci_dev *dev); 18e1926b8c8b7c Ahmed S. Darwish 2022-11-11 110 void pci_msix_shutdown(struct pci_dev *dev); b12d0bec385b7a Ahmed S. Darwish 2022-11-11 111 void pci_free_msi_irqs(struct pci_dev *dev); bbda3407982211 Ahmed S. Darwish 2022-11-11 112 int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec, struct irq_affinity *affd); be7496c1ef47e1 Ahmed S. Darwish 2022-11-11 @113 int __pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries, int minvec, be7496c1ef47e1 Ahmed S. Darwish 2022-11-11 114 int maxvec, struct irq_affinity *affd, int flags); 57127da98bc876 Ahmed S. Darwish 2022-11-11 115 void __pci_restore_msi_state(struct pci_dev *dev); 57127da98bc876 Ahmed S. Darwish 2022-11-11 116 void __pci_restore_msix_state(struct pci_dev *dev); b12d0bec385b7a Ahmed S. Darwish 2022-11-11 117 :::::: The code at line 113 was first introduced by commit :::::: be7496c1ef47e1ba8c4b389ee23178fcf066cc4e PCI/MSI: Move pci_enable_msix_range() to api.c :::::: TO: Ahmed S. Darwish <darwi(a)linutronix.de> :::::: CC: Thomas Gleixner <tglx(a)linutronix.de> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] mm: vmscan: fix page cache limit work condition
by Wupeng Ma 23 Sep '25

23 Sep '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4SK3S CVE: NA -------------------------------- Commit 92cd2e7fa82d ("mm:vmscan: add the missing check of page_cache_over_limit") add limit check for shrink_page_cache_work to stop page cache below limit. However this limit is only checked iff memory reliable is enable, since page cache limit can be enabled without memory reliable. Enable this limit check in all scenarios. Fixes: 92cd2e7fa82d ("mm:vmscan: add the missing check of page_cache_over_limit") Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/vmscan.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/mm/vmscan.c b/mm/vmscan.c index 6a649f02666f..fa08ffd043de 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -4060,8 +4060,7 @@ static void shrink_page_cache_work(struct work_struct *w) if (vm_cache_reclaim_s == 0 || !vm_cache_reclaim_enable) return; - if (mem_reliable_is_enabled() && - (!vm_cache_limit_mbytes || !page_cache_over_limit())) + if (!vm_cache_limit_mbytes || !page_cache_over_limit()) return; /* It should wait more time if we hardly reclaim the page cache */ -- 2.43.0

2 1

[PATCH OLK-5.10] ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
by Yongjian Sun 23 Sep '25

23 Sep '25

From: Theodore Ts'o <tytso(a)mit.edu> mainline inclusion from mainline-v6.17-rc1 commit 099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICWGGD CVE: CVE-2025-38701 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missing the system.data extended attribute. Since this can happen due to a maiciouly fuzzed file system, we shouldn't BUG, but rather, report it as a corrupted file system. Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii ext4_create_inline_data() and ext4_inline_data_truncate(). Reported-by: syzbot+544248a761451c0df72f(a)syzkaller.appspotmail.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/inline.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c index 471f6ef77c01..2bff874f1d81 100644 --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -296,7 +296,11 @@ static int ext4_create_inline_data(handle_t *handle, if (error) goto out; - BUG_ON(!is.s.not_found); + if (!is.s.not_found) { + EXT4_ERROR_INODE(inode, "unexpected inline data xattr"); + error = -EFSCORRUPTED; + goto out; + } error = ext4_xattr_ibody_set(handle, inode, &i, &is); if (error) { @@ -347,7 +351,11 @@ static int ext4_update_inline_data(handle_t *handle, struct inode *inode, if (error) goto out; - BUG_ON(is.s.not_found); + if (is.s.not_found) { + EXT4_ERROR_INODE(inode, "missing inline data xattr"); + error = -EFSCORRUPTED; + goto out; + } len -= EXT4_MIN_INLINE_DATA_SIZE; value = kzalloc(len, GFP_NOFS); @@ -1945,7 +1953,12 @@ int ext4_inline_data_truncate(struct inode *inode, int *has_inline) if ((err = ext4_xattr_ibody_find(inode, &i, &is)) != 0) goto out_error; - BUG_ON(is.s.not_found); + if (is.s.not_found) { + EXT4_ERROR_INODE(inode, + "missing inline data xattr"); + err = -EFSCORRUPTED; + goto out_error; + } value_len = le32_to_cpu(is.s.here->e_value_size); value = kmalloc(value_len, GFP_NOFS); -- 2.39.2

2 1

[PATCH OLK-6.6] arm64/mpam: Update MB hardlimit and priority default value forcely
by Zeng Heng 23 Sep '25

23 Sep '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICX9YF -------------------------------- When the root group config is absent, mpam_reprogram_ris_partid() must deliver defaults setting of the hardlimit and priority explicitly. Otherwise root group would be allowed to utilize idle memory bandwidth. Fixes: ec8cf750710c ("arm64/mpam: Update QoS partition default value") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_devices.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/drivers/platform/mpam/mpam_devices.c b/drivers/platform/mpam/mpam_devices.c index 250032f58659..783f9ffb270c 100644 --- a/drivers/platform/mpam/mpam_devices.c +++ b/drivers/platform/mpam/mpam_devices.c @@ -1258,6 +1258,22 @@ static u32 mpam_cpbm_hisi_workaround(u32 cpbm, u8 cache_level) return cpbm; } +static u16 mpam_intpri_hisi_workaround(struct mpam_msc_ris *ris, u16 intpri) +{ + struct mpam_class *class = ris->comp->class; + + if (read_cpuid_implementor() != ARM_CPU_IMP_HISI) + return intpri; + + if (class->type == MPAM_CLASS_MEMORY) + return 3; + + if (class->level == 3) + return 0; + + return intpri; +} + static void mpam_reprogram_ris_partid(struct mpam_msc_ris *ris, u16 partid, struct mpam_config *cfg) { @@ -1325,7 +1341,7 @@ static void mpam_reprogram_ris_partid(struct mpam_msc_ris *ris, u16 partid, if (mpam_has_feature(mpam_feat_max_limit, cfg)) limit = cfg->max_limit; else - limit = false; + limit = true; if (limit) mpam_write_partsel_reg(msc, MBW_MAX, bwa_fract | @@ -1343,6 +1359,7 @@ static void mpam_reprogram_ris_partid(struct mpam_msc_ris *ris, u16 partid, intpri = 0; if (mpam_has_feature(mpam_feat_intpri_part, rprops)) { + intpri = mpam_intpri_hisi_workaround(ris, intpri); if (mpam_has_feature(mpam_feat_intpri_part, cfg)) pri_val |= FIELD_PREP(MPAMCFG_PRI_INTPRI, cfg->intpri); else -- 2.25.1

2 1

[PATCH OLK-6.6] arm64/mpam: Add quirk for hisi cpbm_wd field
by Zeng Heng 23 Sep '25

23 Sep '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICX9YF -------------------------------- The bit mask width indicated in the MPAMF_CPOR_IDR_CPBM_WD IDR register of MPAM is inconsistent with the actual hardware capability. This incorrectly limits the L3 capacity in real use. Therefore, software has to hard-code a workaround to align with the actual CPBM bit width. Fixes: 051d021d1c1a ("arm_mpam: Probe the hardware features resctrl supports") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_devices.c | 57 +++++++++++++++++++++++++-- drivers/platform/mpam/mpam_internal.h | 2 + drivers/platform/mpam/mpam_resctrl.c | 8 +++- 3 files changed, 62 insertions(+), 5 deletions(-) diff --git a/drivers/platform/mpam/mpam_devices.c b/drivers/platform/mpam/mpam_devices.c index 516ffc4b4a3d..250032f58659 100644 --- a/drivers/platform/mpam/mpam_devices.c +++ b/drivers/platform/mpam/mpam_devices.c @@ -562,6 +562,28 @@ static struct mpam_msc_ris *mpam_get_or_create_ris(struct mpam_msc *msc, return found; } +u16 mpam_cpbm_wd_hisi_workaround(u16 cpbm_wd, enum mpam_device_features feat, + u8 cache_level) +{ + static const struct midr_range cpus[] = { + MIDR_ALL_VERSIONS(MIDR_HISI_HIP12), + { /* sentinel */ } + }; + + if (cache_level != 3) + return cpbm_wd; + + if (is_midr_in_range_list(read_cpuid_id(), cpus)) { + if (feat == mpam_feat_cpor_part) + return 19; + else if (feat == mpam_feat_ccap_part || + feat == mpam_feat_cmin) + return 21; + } + + return cpbm_wd; +} + static void mpam_ris_hw_probe(struct mpam_msc_ris *ris) { int err; @@ -591,7 +613,9 @@ static void mpam_ris_hw_probe(struct mpam_msc_ris *ris) if (FIELD_GET(MPAMF_IDR_HAS_CPOR_PART, ris->idr)) { u32 cpor_features = mpam_read_partsel_reg(msc, CPOR_IDR); - props->cpbm_wd = FIELD_GET(MPAMF_CPOR_IDR_CPBM_WD, cpor_features); + props->cpbm_wd = mpam_cpbm_wd_hisi_workaround( + FIELD_GET(MPAMF_CPOR_IDR_CPBM_WD, cpor_features), + mpam_feat_cpor_part, class->level); if (props->cpbm_wd) mpam_set_feature(mpam_feat_cpor_part, props); } @@ -1212,6 +1236,28 @@ static void mpam_reset_msc_bitmap(struct mpam_msc *msc, u16 reg, u16 wd) __mpam_write_reg(msc, reg, bm); } +static u32 mpam_cpbm_hisi_workaround(u32 cpbm, u8 cache_level) +{ + static const struct midr_range cpus[] = { + MIDR_ALL_VERSIONS(MIDR_HISI_HIP12), + { /* sentinel */ } + }; + + if (cache_level != 3 || + !is_midr_in_range_list(read_cpuid_id(), cpus)) + return cpbm; + + if (cpbm & BIT(18)) + cpbm |= (BIT(19) | BIT(20)); + + if (cpbm & BIT(17)) + cpbm |= BIT(18); + else + cpbm &= ~BIT(18); + + return cpbm; +} + static void mpam_reprogram_ris_partid(struct mpam_msc_ris *ris, u16 partid, struct mpam_config *cfg) { @@ -1232,10 +1278,15 @@ static void mpam_reprogram_ris_partid(struct mpam_msc_ris *ris, u16 partid, if (mpam_has_feature(mpam_feat_cpor_part, rprops)) { if (mpam_has_feature(mpam_feat_cpor_part, cfg)) - mpam_write_partsel_reg(msc, CPBM, cfg->cpbm); + mpam_write_partsel_reg(msc, CPBM, + mpam_cpbm_hisi_workaround(cfg->cpbm, + ris->comp->class->level)); else mpam_reset_msc_bitmap(msc, MPAMCFG_CPBM, - rprops->cpbm_wd); + mpam_cpbm_wd_hisi_workaround( + rprops->cpbm_wd, + mpam_feat_cpor_part, + ris->comp->class->level)); } if (mpam_has_feature(mpam_feat_ccap_part, rprops)) { diff --git a/drivers/platform/mpam/mpam_internal.h b/drivers/platform/mpam/mpam_internal.h index ff1890b3a78e..204005331334 100644 --- a/drivers/platform/mpam/mpam_internal.h +++ b/drivers/platform/mpam/mpam_internal.h @@ -328,6 +328,8 @@ int mpam_resctrl_offline_cpu(unsigned int cpu); int mpam_resctrl_setup(void); void mpam_resctrl_exit(void); +u16 mpam_cpbm_wd_hisi_workaround(u16 cpbm_wd, enum mpam_device_features feat, u8 cache_level); + /* * MPAM MSCs have the following register layout. See: * Arm Architecture Reference Manual Supplement - Memory System Resource diff --git a/drivers/platform/mpam/mpam_resctrl.c b/drivers/platform/mpam/mpam_resctrl.c index 6540b84e0f14..34fcb03c1eeb 100644 --- a/drivers/platform/mpam/mpam_resctrl.c +++ b/drivers/platform/mpam/mpam_resctrl.c @@ -691,7 +691,9 @@ static u16 percent_to_ca_max(u32 pc, u8 wd) if (read_cpuid_implementor() != ARM_CPU_IMP_HISI) return percent_to_mbw_max(pc, wd); - valid_max = l3->cache.cbm_len; + valid_max = mpam_cpbm_wd_hisi_workaround(l3->cache.cbm_len, + mpam_feat_ccap_part, + l3->cache_level); if (pc >= MAX_MBA_BW) return valid_max << (16 - wd); @@ -707,7 +709,9 @@ static u16 ca_max_to_percent(u16 ca_max, u8 wd) if (read_cpuid_implementor() != ARM_CPU_IMP_HISI) return mbw_max_to_percent(ca_max, wd); - valid_max = l3->cache.cbm_len; + valid_max = mpam_cpbm_wd_hisi_workaround(l3->cache.cbm_len, + mpam_feat_ccap_part, + l3->cache_level); ca_max = ca_max >> (16 - wd); if (ca_max >= valid_max) -- 2.25.1

2 1

[openeuler:OLK-5.10 3207/3207] include/linux/compiler_types.h:323:38: error: call to '__compiletime_assert_183' declared with attribute error: BUILD_BUG failed
by kernel test robot 23 Sep '25

23 Sep '25

Hi Marc, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 3838d60c6f0bda86f712fbcee935bfb42e07b8bb commit: 611b93b7366a1e0c9df51c4628ea51bfe6db74d9 [3207/3207] clocksource/arm_arch_timer: Add build-time guards for unhandled register accesses config: arm64-randconfig-003-20250923 (https://download.01.org/0day-ci/archive/20250923/202509231925.VzrKhKii-lkp@…) compiler: aarch64-linux-gcc (GCC) 7.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250923/202509231925.VzrKhKii-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509231925.VzrKhKii-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from <command-line>:0:0: In function 'arch_timer_reg_read_cp15', inlined from 'erratum_set_next_event_tval_generic' at drivers/clocksource/arm_arch_timer.c:157:7: >> include/linux/compiler_types.h:323:38: error: call to '__compiletime_assert_183' declared with attribute error: BUILD_BUG failed _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:304:4: note: in definition of macro '__compiletime_assert' prefix ## suffix(); \ ^~~~~~ include/linux/compiler_types.h:323:2: note: in expansion of macro '_compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^~~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert' #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg) ^~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:59:21: note: in expansion of macro 'BUILD_BUG_ON_MSG' #define BUILD_BUG() BUILD_BUG_ON_MSG(1, "BUILD_BUG failed") ^~~~~~~~~~~~~~~~ arch/arm64/include/asm/arch_timer.h:159:2: note: in expansion of macro 'BUILD_BUG' BUILD_BUG(); ^~~~~~~~~ In function 'arch_timer_reg_write_cp15', inlined from 'erratum_set_next_event_tval_generic' at drivers/clocksource/arm_arch_timer.c:122:3: include/linux/compiler_types.h:323:38: error: call to '__compiletime_assert_180' declared with attribute error: BUILD_BUG failed _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:304:4: note: in definition of macro '__compiletime_assert' prefix ## suffix(); \ ^~~~~~ include/linux/compiler_types.h:323:2: note: in expansion of macro '_compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^~~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:39:37: note: in expansion of macro 'compiletime_assert' #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg) ^~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:59:21: note: in expansion of macro 'BUILD_BUG_ON_MSG' #define BUILD_BUG() BUILD_BUG_ON_MSG(1, "BUILD_BUG failed") ^~~~~~~~~~~~~~~~ arch/arm64/include/asm/arch_timer.h:130:3: note: in expansion of macro 'BUILD_BUG' BUILD_BUG(); ^~~~~~~~~ vim +/__compiletime_assert_183 +323 include/linux/compiler_types.h eb5c2d4b45e3d2d Will Deacon 2020-07-21 309 eb5c2d4b45e3d2d Will Deacon 2020-07-21 310 #define _compiletime_assert(condition, msg, prefix, suffix) \ eb5c2d4b45e3d2d Will Deacon 2020-07-21 311 __compiletime_assert(condition, msg, prefix, suffix) eb5c2d4b45e3d2d Will Deacon 2020-07-21 312 eb5c2d4b45e3d2d Will Deacon 2020-07-21 313 /** eb5c2d4b45e3d2d Will Deacon 2020-07-21 314 * compiletime_assert - break build and emit msg if condition is false eb5c2d4b45e3d2d Will Deacon 2020-07-21 315 * @condition: a compile-time constant condition to check eb5c2d4b45e3d2d Will Deacon 2020-07-21 316 * @msg: a message to emit if condition is false eb5c2d4b45e3d2d Will Deacon 2020-07-21 317 * eb5c2d4b45e3d2d Will Deacon 2020-07-21 318 * In tradition of POSIX assert, this macro will break the build if the eb5c2d4b45e3d2d Will Deacon 2020-07-21 319 * supplied condition is *false*, emitting the supplied error message if the eb5c2d4b45e3d2d Will Deacon 2020-07-21 320 * compiler has support to do so. eb5c2d4b45e3d2d Will Deacon 2020-07-21 321 */ eb5c2d4b45e3d2d Will Deacon 2020-07-21 322 #define compiletime_assert(condition, msg) \ eb5c2d4b45e3d2d Will Deacon 2020-07-21 @323 _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) eb5c2d4b45e3d2d Will Deacon 2020-07-21 324 :::::: The code at line 323 was first introduced by commit :::::: eb5c2d4b45e3d2d5d052ea6b8f1463976b1020d5 compiler.h: Move compiletime_assert() macros into compiler_types.h :::::: TO: Will Deacon <will(a)kernel.org> :::::: CC: Will Deacon <will(a)kernel.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] nfsd: call op_release, even when op_func returns an error
by Li Lingfeng 23 Sep '25

23 Sep '25

From: Jeff Layton <jlayton(a)kernel.org> mainline inclusion from mainline-v6.3-rc6 commit 15a8b55dbb1ba154d82627547c5761cac884d810 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY4HQ CVE: CVE-2023-53241 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- For ops with "trivial" replies, nfsd4_encode_operation will shortcut most of the encoding work and skip to just marshalling up the status. One of the things it skips is calling op_release. This could cause a memory leak in the layoutget codepath if there is an error at an inopportune time. Have the compound processing engine always call op_release, even when op_func sets an error in op->status. With this change, we also need nfsd4_block_get_device_info_scsi to set the gd_device pointer to NULL on error to avoid a double free. Reported-by: Zhi Li <yieli(a)redhat.com> Link: https://bugzilla.redhat.com/show_bug.cgi?id=2181403 Fixes: 34b1744c91cc ("nfsd4: define ->op_release for compound ops") Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/blocklayout.c fs/nfsd/nfs4xdr.c [Commit 8c6aabd1c72b ("nfsd/blocklayout: use ->get_unique_id instead of sending SCSI commands") free pnfs_block_deviceaddr in the error path of nfsd4_block_get_device_info_scsi; commit 08281341be8e ("NFSD: Add tracepoints in nfsd4_decode/encode_compound()") add trace_nfsd_compound_encode_err in nfsd4_encode_operation.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4xdr.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c index 1c11042dafb8..31d56546021b 100644 --- a/fs/nfsd/nfs4xdr.c +++ b/fs/nfsd/nfs4xdr.c @@ -5183,10 +5183,8 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op) __be32 *p; p = xdr_reserve_space(xdr, 8); - if (!p) { - WARN_ON_ONCE(1); - return; - } + if (!p) + goto release; *p++ = cpu_to_be32(op->opnum); post_err_offset = xdr->buf->len; @@ -5199,8 +5197,6 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op) !nfsd4_enc_ops[op->opnum]); encoder = nfsd4_enc_ops[op->opnum]; op->status = encoder(resp, op->status, &op->u); - if (opdesc && opdesc->op_release) - opdesc->op_release(&op->u); xdr_commit_encode(xdr); /* nfsd4_check_resp_size guarantees enough room for error status */ @@ -5242,6 +5238,9 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op) status: /* Note that op->status is already in network byte order: */ write_bytes_to_xdr_buf(xdr->buf, post_err_offset - 4, &op->status, 4); +release: + if (opdesc && opdesc->op_release) + opdesc->op_release(&op->u); } /* -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] nfsd: call op_release, even when op_func returns an error
by Li Lingfeng 23 Sep '25

23 Sep '25

From: Jeff Layton <jlayton(a)kernel.org> mainline inclusion from mainline-v6.3-rc6 commit 15a8b55dbb1ba154d82627547c5761cac884d810 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY4HQ CVE: CVE-2023-53241 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- For ops with "trivial" replies, nfsd4_encode_operation will shortcut most of the encoding work and skip to just marshalling up the status. One of the things it skips is calling op_release. This could cause a memory leak in the layoutget codepath if there is an error at an inopportune time. Have the compound processing engine always call op_release, even when op_func sets an error in op->status. With this change, we also need nfsd4_block_get_device_info_scsi to set the gd_device pointer to NULL on error to avoid a double free. Reported-by: Zhi Li <yieli(a)redhat.com> Link: https://bugzilla.redhat.com/show_bug.cgi?id=2181403 Fixes: 34b1744c91cc ("nfsd4: define ->op_release for compound ops") Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/blocklayout.c fs/nfsd/nfs4xdr.c [Commit 8c6aabd1c72b ("nfsd/blocklayout: use ->get_unique_id instead of sending SCSI commands") free pnfs_block_deviceaddr in the error path of nfsd4_block_get_device_info_scsi; commit 08281341be8e ("NFSD: Add tracepoints in nfsd4_decode/encode_compound()") add trace_nfsd_compound_encode_err in nfsd4_encode_operation.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4xdr.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c index db0beefe65ec..645a3d4807b8 100644 --- a/fs/nfsd/nfs4xdr.c +++ b/fs/nfsd/nfs4xdr.c @@ -4411,10 +4411,8 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op) __be32 *p; p = xdr_reserve_space(xdr, 8); - if (!p) { - WARN_ON_ONCE(1); - return; - } + if (!p) + goto release; *p++ = cpu_to_be32(op->opnum); post_err_offset = xdr->buf->len; @@ -4427,8 +4425,6 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op) !nfsd4_enc_ops[op->opnum]); encoder = nfsd4_enc_ops[op->opnum]; op->status = encoder(resp, op->status, &op->u); - if (opdesc && opdesc->op_release) - opdesc->op_release(&op->u); xdr_commit_encode(xdr); /* nfsd4_check_resp_size guarantees enough room for error status */ @@ -4470,6 +4466,9 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op) status: /* Note that op->status is already in network byte order: */ write_bytes_to_xdr_buf(xdr->buf, post_err_offset - 4, &op->status, 4); +release: + if (opdesc && opdesc->op_release) + opdesc->op_release(&op->u); } /* -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] mm: vmscan: enable shrink_page_cache_work limit
by Wupeng Ma 23 Sep '25

23 Sep '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4SK3S CVE: NA -------------------------------- Commit 92cd2e7fa82d ("mm:vmscan: add the missing check of page_cache_over_limit") add limit check for shrink_page_cache_work to stop page cache below limit. However this limit is only checked iff memory reliable is enable, since page cache limit can be enabled without memory reliable. Enable this limit check in all scenarios. Fixes: 92cd2e7fa82d ("mm:vmscan: add the missing check of page_cache_over_limit") Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/vmscan.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/mm/vmscan.c b/mm/vmscan.c index 6a649f02666f..fa08ffd043de 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -4060,8 +4060,7 @@ static void shrink_page_cache_work(struct work_struct *w) if (vm_cache_reclaim_s == 0 || !vm_cache_reclaim_enable) return; - if (mem_reliable_is_enabled() && - (!vm_cache_limit_mbytes || !page_cache_over_limit())) + if (!vm_cache_limit_mbytes || !page_cache_over_limit()) return; /* It should wait more time if we hardly reclaim the page cache */ -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] mm: vmscan: enable shrink_page_cache_work limit
by Wupeng Ma 23 Sep '25

23 Sep '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4SK3S CVE: NA -------------------------------- Commit 92cd2e7fa82d ("mm:vmscan: add the missing check of page_cache_over_limit") add limit check for shrink_page_cache_work to stop page cache below limit. However this limit is only checked iff memory reliable is enable, since page cache limit can be enabled without memory reliable. Enable this limit check in all scenarios. Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/vmscan.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/mm/vmscan.c b/mm/vmscan.c index 6a649f02666f..fa08ffd043de 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -4060,8 +4060,7 @@ static void shrink_page_cache_work(struct work_struct *w) if (vm_cache_reclaim_s == 0 || !vm_cache_reclaim_enable) return; - if (mem_reliable_is_enabled() && - (!vm_cache_limit_mbytes || !page_cache_over_limit())) + if (!vm_cache_limit_mbytes || !page_cache_over_limit()) return; /* It should wait more time if we hardly reclaim the page cache */ -- 2.43.0

2 1

[openeuler:OLK-6.6 2909/2909] drivers/gpu/drm/phytium/phytium_gem.c:174:5: sparse: sparse: symbol 'phytium_gem_prime_mmap' was not declared. Should it be static?
by kernel test robot 23 Sep '25

23 Sep '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: be758a5796c3d280deb877699c41fd0cd04e1deb commit: 3b4a5906fa714bdc9a15fc04374942888737eb4c [2909/2909] drm/phytium: Fix Phytium DRM build fail config: arm64-randconfig-r121-20250923 (https://download.01.org/0day-ci/archive/20250923/202509231756.bOMWC43K-lkp@…) compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250923/202509231756.bOMWC43K-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509231756.bOMWC43K-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/gpu/drm/phytium/phytium_gem.c: note: in included file (through arch/arm64/include/asm/cpufeature.h, arch/arm64/include/asm/ptrace.h, arch/arm64/include/asm/irqflags.h, ...): arch/arm64/include/asm/cputype.h:163:9: sparse: sparse: preprocessor token PHYTIUM_CPU_PART_FTC862 redefined arch/arm64/include/asm/cputype.h:110:9: sparse: this was the original definition drivers/gpu/drm/phytium/phytium_gem.c:22:5: sparse: sparse: symbol 'phytium_memory_pool_alloc' was not declared. Should it be static? drivers/gpu/drm/phytium/phytium_gem.c:37:6: sparse: sparse: symbol 'phytium_memory_pool_free' was not declared. Should it be static? drivers/gpu/drm/phytium/phytium_gem.c:161:5: sparse: sparse: symbol 'phytium_gem_prime_vmap' was not declared. Should it be static? drivers/gpu/drm/phytium/phytium_gem.c:170:6: sparse: sparse: symbol 'phytium_gem_prime_vunmap' was not declared. Should it be static? >> drivers/gpu/drm/phytium/phytium_gem.c:174:5: sparse: sparse: symbol 'phytium_gem_prime_mmap' was not declared. Should it be static? drivers/gpu/drm/phytium/phytium_gem.c:186:5: sparse: sparse: symbol 'phytium_dma_transfer' was not declared. Should it be static? vim +/phytium_gem_prime_mmap +174 drivers/gpu/drm/phytium/phytium_gem.c b80df10f845813 lishuo 2024-01-31 21 b80df10f845813 lishuo 2024-01-31 @22 int phytium_memory_pool_alloc(struct phytium_display_private *priv, void **pvaddr, b80df10f845813 lishuo 2024-01-31 23 phys_addr_t *phys_addr, uint64_t size) b80df10f845813 lishuo 2024-01-31 24 { b80df10f845813 lishuo 2024-01-31 25 unsigned long vaddr; b80df10f845813 lishuo 2024-01-31 26 b80df10f845813 lishuo 2024-01-31 27 vaddr = gen_pool_alloc(priv->memory_pool, size); b80df10f845813 lishuo 2024-01-31 28 if (!vaddr) b80df10f845813 lishuo 2024-01-31 29 return -ENOMEM; b80df10f845813 lishuo 2024-01-31 30 b80df10f845813 lishuo 2024-01-31 31 *phys_addr = gen_pool_virt_to_phys(priv->memory_pool, vaddr); b80df10f845813 lishuo 2024-01-31 32 b80df10f845813 lishuo 2024-01-31 33 *pvaddr = (void *)vaddr; b80df10f845813 lishuo 2024-01-31 34 return 0; b80df10f845813 lishuo 2024-01-31 35 } b80df10f845813 lishuo 2024-01-31 36 b80df10f845813 lishuo 2024-01-31 37 void phytium_memory_pool_free(struct phytium_display_private *priv, void *vaddr, uint64_t size) b80df10f845813 lishuo 2024-01-31 38 { b80df10f845813 lishuo 2024-01-31 39 gen_pool_free(priv->memory_pool, (unsigned long)vaddr, size); b80df10f845813 lishuo 2024-01-31 40 } b80df10f845813 lishuo 2024-01-31 41 b80df10f845813 lishuo 2024-01-31 42 int phytium_memory_pool_init(struct device *dev, struct phytium_display_private *priv) b80df10f845813 lishuo 2024-01-31 43 { b80df10f845813 lishuo 2024-01-31 44 int ret = 0; b80df10f845813 lishuo 2024-01-31 45 b80df10f845813 lishuo 2024-01-31 46 priv->memory_pool = gen_pool_create(VRAM_POOL_ALLOC_ORDER, -1); b80df10f845813 lishuo 2024-01-31 47 if (priv->memory_pool == NULL) { b80df10f845813 lishuo 2024-01-31 48 DRM_ERROR("fail to create memory pool\n"); b80df10f845813 lishuo 2024-01-31 49 ret = -1; b80df10f845813 lishuo 2024-01-31 50 goto failed_create_pool; b80df10f845813 lishuo 2024-01-31 51 } b80df10f845813 lishuo 2024-01-31 52 b80df10f845813 lishuo 2024-01-31 53 ret = gen_pool_add_virt(priv->memory_pool, (unsigned long)priv->pool_virt_addr, b80df10f845813 lishuo 2024-01-31 54 priv->pool_phys_addr, priv->pool_size, -1); b80df10f845813 lishuo 2024-01-31 55 if (ret) { b80df10f845813 lishuo 2024-01-31 56 DRM_ERROR("fail to add vram pool\n"); b80df10f845813 lishuo 2024-01-31 57 ret = -1; b80df10f845813 lishuo 2024-01-31 58 goto failed_add_pool_virt; b80df10f845813 lishuo 2024-01-31 59 } b80df10f845813 lishuo 2024-01-31 60 b80df10f845813 lishuo 2024-01-31 61 return 0; b80df10f845813 lishuo 2024-01-31 62 b80df10f845813 lishuo 2024-01-31 63 failed_add_pool_virt: b80df10f845813 lishuo 2024-01-31 64 gen_pool_destroy(priv->memory_pool); b80df10f845813 lishuo 2024-01-31 65 b80df10f845813 lishuo 2024-01-31 66 failed_create_pool: b80df10f845813 lishuo 2024-01-31 67 return ret; b80df10f845813 lishuo 2024-01-31 68 } b80df10f845813 lishuo 2024-01-31 69 b80df10f845813 lishuo 2024-01-31 70 void phytium_memory_pool_fini(struct device *dev, struct phytium_display_private *priv) b80df10f845813 lishuo 2024-01-31 71 { b80df10f845813 lishuo 2024-01-31 72 gen_pool_destroy(priv->memory_pool); b80df10f845813 lishuo 2024-01-31 73 } b80df10f845813 lishuo 2024-01-31 74 b80df10f845813 lishuo 2024-01-31 75 struct sg_table * b80df10f845813 lishuo 2024-01-31 76 phytium_gem_prime_get_sg_table(struct drm_gem_object *obj) b80df10f845813 lishuo 2024-01-31 77 { b80df10f845813 lishuo 2024-01-31 78 struct phytium_gem_object *phytium_gem_obj = to_phytium_gem_obj(obj); b80df10f845813 lishuo 2024-01-31 79 struct sg_table *sgt; b80df10f845813 lishuo 2024-01-31 80 struct drm_device *dev = obj->dev; b80df10f845813 lishuo 2024-01-31 81 int ret; b80df10f845813 lishuo 2024-01-31 82 struct page *page = NULL; b80df10f845813 lishuo 2024-01-31 83 b80df10f845813 lishuo 2024-01-31 84 sgt = kzalloc(sizeof(*sgt), GFP_KERNEL); b80df10f845813 lishuo 2024-01-31 85 if (!sgt) { b80df10f845813 lishuo 2024-01-31 86 DRM_DEBUG_KMS("malloc sgt fail\n"); b80df10f845813 lishuo 2024-01-31 87 return ERR_PTR(-ENOMEM); b80df10f845813 lishuo 2024-01-31 88 } b80df10f845813 lishuo 2024-01-31 89 8c04aa95ffa8ae Jiakun Shuai 2024-05-20 90 if ((phytium_gem_obj->memory_type == MEMORY_TYPE_VRAM_WC) || 8c04aa95ffa8ae Jiakun Shuai 2024-05-20 91 (phytium_gem_obj->memory_type == MEMORY_TYPE_VRAM_DEVICE) || b80df10f845813 lishuo 2024-01-31 92 (phytium_gem_obj->memory_type == MEMORY_TYPE_SYSTEM_CARVEOUT)) { b80df10f845813 lishuo 2024-01-31 93 ret = sg_alloc_table(sgt, 1, GFP_KERNEL); b80df10f845813 lishuo 2024-01-31 94 if (ret) { b80df10f845813 lishuo 2024-01-31 95 DRM_ERROR("failed to allocate sg\n"); b80df10f845813 lishuo 2024-01-31 96 goto sgt_free; b80df10f845813 lishuo 2024-01-31 97 } e2cdf30a3e12bb XuYan 2025-04-09 98 page = pfn_to_page(__phys_to_pfn(phytium_gem_obj->phys_addr)); b80df10f845813 lishuo 2024-01-31 99 sg_set_page(sgt->sgl, page, PAGE_ALIGN(phytium_gem_obj->size), 0); b80df10f845813 lishuo 2024-01-31 100 } else if (phytium_gem_obj->memory_type == MEMORY_TYPE_SYSTEM_UNIFIED) { b80df10f845813 lishuo 2024-01-31 101 ret = dma_get_sgtable_attrs(dev->dev, sgt, phytium_gem_obj->vaddr, b80df10f845813 lishuo 2024-01-31 102 phytium_gem_obj->iova, phytium_gem_obj->size, b80df10f845813 lishuo 2024-01-31 103 DMA_ATTR_WRITE_COMBINE); b80df10f845813 lishuo 2024-01-31 104 if (ret) { b80df10f845813 lishuo 2024-01-31 105 DRM_ERROR("failed to allocate sgt, %d\n", ret); b80df10f845813 lishuo 2024-01-31 106 goto sgt_free; b80df10f845813 lishuo 2024-01-31 107 } b80df10f845813 lishuo 2024-01-31 108 } b80df10f845813 lishuo 2024-01-31 109 b80df10f845813 lishuo 2024-01-31 110 return sgt; b80df10f845813 lishuo 2024-01-31 111 sgt_free: b80df10f845813 lishuo 2024-01-31 112 kfree(sgt); b80df10f845813 lishuo 2024-01-31 113 return ERR_PTR(ret); b80df10f845813 lishuo 2024-01-31 114 } b80df10f845813 lishuo 2024-01-31 115 b80df10f845813 lishuo 2024-01-31 116 struct drm_gem_object * b80df10f845813 lishuo 2024-01-31 117 phytium_gem_prime_import_sg_table(struct drm_device *dev, b80df10f845813 lishuo 2024-01-31 118 struct dma_buf_attachment *attach, b80df10f845813 lishuo 2024-01-31 119 struct sg_table *sgt) b80df10f845813 lishuo 2024-01-31 120 { b80df10f845813 lishuo 2024-01-31 121 struct phytium_gem_object *phytium_gem_obj = NULL; b80df10f845813 lishuo 2024-01-31 122 struct scatterlist *s; b80df10f845813 lishuo 2024-01-31 123 dma_addr_t expected; b80df10f845813 lishuo 2024-01-31 124 int ret, i; b80df10f845813 lishuo 2024-01-31 125 b80df10f845813 lishuo 2024-01-31 126 phytium_gem_obj = kzalloc(sizeof(*phytium_gem_obj), GFP_KERNEL); b80df10f845813 lishuo 2024-01-31 127 if (!phytium_gem_obj) { b80df10f845813 lishuo 2024-01-31 128 DRM_ERROR("failed to allocate phytium_gem_obj\n"); b80df10f845813 lishuo 2024-01-31 129 ret = -ENOMEM; b80df10f845813 lishuo 2024-01-31 130 goto failed_malloc; b80df10f845813 lishuo 2024-01-31 131 } b80df10f845813 lishuo 2024-01-31 132 b80df10f845813 lishuo 2024-01-31 133 ret = drm_gem_object_init(dev, &phytium_gem_obj->base, attach->dmabuf->size); b80df10f845813 lishuo 2024-01-31 134 if (ret) { b80df10f845813 lishuo 2024-01-31 135 DRM_ERROR("failed to initialize drm gem object: %d\n", ret); b80df10f845813 lishuo 2024-01-31 136 goto failed_object_init; b80df10f845813 lishuo 2024-01-31 137 } b80df10f845813 lishuo 2024-01-31 138 b80df10f845813 lishuo 2024-01-31 139 expected = sg_dma_address(sgt->sgl); b80df10f845813 lishuo 2024-01-31 140 for_each_sg(sgt->sgl, s, sgt->nents, i) { b80df10f845813 lishuo 2024-01-31 141 if (sg_dma_address(s) != expected) { b80df10f845813 lishuo 2024-01-31 142 DRM_ERROR("sg_table is not contiguous"); b80df10f845813 lishuo 2024-01-31 143 ret = -EINVAL; b80df10f845813 lishuo 2024-01-31 144 goto failed_check_continue; b80df10f845813 lishuo 2024-01-31 145 } b80df10f845813 lishuo 2024-01-31 146 expected = sg_dma_address(s) + sg_dma_len(s); b80df10f845813 lishuo 2024-01-31 147 } b80df10f845813 lishuo 2024-01-31 148 b80df10f845813 lishuo 2024-01-31 149 phytium_gem_obj->iova = sg_dma_address(sgt->sgl); b80df10f845813 lishuo 2024-01-31 150 phytium_gem_obj->sgt = sgt; b80df10f845813 lishuo 2024-01-31 151 b80df10f845813 lishuo 2024-01-31 152 return &phytium_gem_obj->base; b80df10f845813 lishuo 2024-01-31 153 failed_check_continue: b80df10f845813 lishuo 2024-01-31 154 drm_gem_object_release(&phytium_gem_obj->base); b80df10f845813 lishuo 2024-01-31 155 failed_object_init: b80df10f845813 lishuo 2024-01-31 156 kfree(phytium_gem_obj); b80df10f845813 lishuo 2024-01-31 157 failed_malloc: b80df10f845813 lishuo 2024-01-31 158 return ERR_PTR(ret); b80df10f845813 lishuo 2024-01-31 159 } b80df10f845813 lishuo 2024-01-31 160 b80df10f845813 lishuo 2024-01-31 161 int phytium_gem_prime_vmap(struct drm_gem_object *obj, struct iosys_map *map) b80df10f845813 lishuo 2024-01-31 162 { b80df10f845813 lishuo 2024-01-31 163 struct phytium_gem_object *phytium_obj = to_phytium_gem_obj(obj); b80df10f845813 lishuo 2024-01-31 164 b80df10f845813 lishuo 2024-01-31 165 iosys_map_set_vaddr(map, phytium_obj->vaddr); b80df10f845813 lishuo 2024-01-31 166 b80df10f845813 lishuo 2024-01-31 167 return 0; b80df10f845813 lishuo 2024-01-31 168 } b80df10f845813 lishuo 2024-01-31 169 b80df10f845813 lishuo 2024-01-31 170 void phytium_gem_prime_vunmap(struct drm_gem_object *obj, struct iosys_map *map) b80df10f845813 lishuo 2024-01-31 171 { e2cdf30a3e12bb XuYan 2025-04-09 172 } b80df10f845813 lishuo 2024-01-31 173 e2cdf30a3e12bb XuYan 2025-04-09 @174 int phytium_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma) e2cdf30a3e12bb XuYan 2025-04-09 175 { e2cdf30a3e12bb XuYan 2025-04-09 176 return phytium_gem_mmap_obj(obj, vma); b80df10f845813 lishuo 2024-01-31 177 } b80df10f845813 lishuo 2024-01-31 178 :::::: The code at line 174 was first introduced by commit :::::: e2cdf30a3e12bb55e76d60e99c0abd7db2917b5c drm/phytium: Fix some Bugs in Phytium Display Engine :::::: TO: XuYan <xuyan1481(a)phytium.com.cn> :::::: CC: xuyan <xuyan1481(a)phytium.com.cn> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] samples/bpf: Fix print issue in dump_swaps()
by Gu Bowen 23 Sep '25

23 Sep '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICA1GK -------------------------------- BPF_SEQ_PRINTF does not support the %*s format for printing, leading to missing print information, fix it. Fixes: be60b1123f28 ("samples/bpf: Add iterator program for swaps") Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- samples/bpf/bpf_rvi/bpf_rvi_swaps.bpf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/samples/bpf/bpf_rvi/bpf_rvi_swaps.bpf.c b/samples/bpf/bpf_rvi/bpf_rvi_swaps.bpf.c index db42929bc7d8..f3138321b17e 100644 --- a/samples/bpf/bpf_rvi/bpf_rvi_swaps.bpf.c +++ b/samples/bpf/bpf_rvi/bpf_rvi_swaps.bpf.c @@ -126,8 +126,8 @@ s64 dump_swaps(struct bpf_iter__generic_single *ctx) /* Reference: swap_show(). Aligned with LXCFS. */ BPF_SEQ_PRINTF(m, "Filename\t\t\t\tType\t\tSize\t\tUsed\t\tPriority\n"); if (swaptotal > 0) - BPF_SEQ_PRINTF(m, "none%*svirtual\t\t%llu\t%llu\t0\n", - 36, " ", swaptotal * kb_per_page, + BPF_SEQ_PRINTF(m, "none\t\t\t\tvirtual\t\t%llu\t\t%llu\t\t0\n", + swaptotal * kb_per_page, swapusage * kb_per_page); // in KB bpf_rcu_read_unlock(); -- 2.43.0

2 1

[openeuler:OLK-6.6 2909/2909] arch/arm64/kvm/virtcca_cvm.c:992:5: sparse: sparse: symbol 'kvm_cvm_vgic_nr_lr' was not declared. Should it be static?
by kernel test robot 23 Sep '25

23 Sep '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: be758a5796c3d280deb877699c41fd0cd04e1deb commit: 62c8d269e7acb9171be225e1f9ebd52c718a0cc0 [2909/2909] Reapply "VirtCCA: cvm support UEFI boot" config: arm64-randconfig-r121-20250923 (https://download.01.org/0day-ci/archive/20250923/202509231602.0wZbxID6-lkp@…) compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250923/202509231602.0wZbxID6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509231602.0wZbxID6-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/arm64/kvm/virtcca_cvm.c:992:5: sparse: sparse: symbol 'kvm_cvm_vgic_nr_lr' was not declared. Should it be static? arch/arm64/kvm/virtcca_cvm.c:1311:5: sparse: sparse: symbol 'cvm_arm_smmu_domain_set_kvm' was not declared. Should it be static? vim +/kvm_cvm_vgic_nr_lr +992 arch/arm64/kvm/virtcca_cvm.c 67e11ee6347c43 Jingxian He 2024-08-03 824 86b9cab8c4752e gongchangsui 2025-03-03 @825 u64 virtcca_get_tmi_version(void) 86b9cab8c4752e gongchangsui 2025-03-03 826 { 86b9cab8c4752e gongchangsui 2025-03-03 827 u64 res = tmi_version(); 86b9cab8c4752e gongchangsui 2025-03-03 828 86b9cab8c4752e gongchangsui 2025-03-03 829 if (res == SMCCC_RET_NOT_SUPPORTED) 86b9cab8c4752e gongchangsui 2025-03-03 830 return 0; 86b9cab8c4752e gongchangsui 2025-03-03 831 return res; 86b9cab8c4752e gongchangsui 2025-03-03 832 } 86b9cab8c4752e gongchangsui 2025-03-03 833 67e11ee6347c43 Jingxian He 2024-08-03 834 static bool is_numa_ipa_range_valid(struct kvm_numa_info *numa_info) 67e11ee6347c43 Jingxian He 2024-08-03 835 { 67e11ee6347c43 Jingxian He 2024-08-03 836 unsigned long i; 67e11ee6347c43 Jingxian He 2024-08-03 837 struct kvm_numa_node *numa_node, *prev_numa_node; 67e11ee6347c43 Jingxian He 2024-08-03 838 67e11ee6347c43 Jingxian He 2024-08-03 839 prev_numa_node = NULL; 67e11ee6347c43 Jingxian He 2024-08-03 840 for (i = 0; i < numa_info->numa_cnt; i++) { 67e11ee6347c43 Jingxian He 2024-08-03 841 numa_node = &numa_info->numa_nodes[i]; 67e11ee6347c43 Jingxian He 2024-08-03 842 if (numa_node->ipa_start + numa_node->ipa_size < numa_node->ipa_start) 67e11ee6347c43 Jingxian He 2024-08-03 843 return false; 67e11ee6347c43 Jingxian He 2024-08-03 844 if (prev_numa_node && 67e11ee6347c43 Jingxian He 2024-08-03 845 numa_node->ipa_start < prev_numa_node->ipa_start + prev_numa_node->ipa_size) 67e11ee6347c43 Jingxian He 2024-08-03 846 return false; 67e11ee6347c43 Jingxian He 2024-08-03 847 prev_numa_node = numa_node; 67e11ee6347c43 Jingxian He 2024-08-03 848 } 67e11ee6347c43 Jingxian He 2024-08-03 849 if (numa_node->ipa_start + numa_node->ipa_size > CVM_IPA_MAX_VAL) 67e11ee6347c43 Jingxian He 2024-08-03 850 return false; 67e11ee6347c43 Jingxian He 2024-08-03 851 return true; 67e11ee6347c43 Jingxian He 2024-08-03 852 } 67e11ee6347c43 Jingxian He 2024-08-03 853 67773feaf93305 gongchangsui 2025-03-04 854 static inline bool is_dtb_info_has_extend_data(u64 dtb_info) 67773feaf93305 gongchangsui 2025-03-04 855 { 67773feaf93305 gongchangsui 2025-03-04 856 return dtb_info & 0x1; 67773feaf93305 gongchangsui 2025-03-04 857 } 67773feaf93305 gongchangsui 2025-03-04 858 67e11ee6347c43 Jingxian He 2024-08-03 859 int kvm_load_user_data(struct kvm *kvm, unsigned long arg) 67e11ee6347c43 Jingxian He 2024-08-03 860 { 67e11ee6347c43 Jingxian He 2024-08-03 861 struct kvm_user_data user_data; 67e11ee6347c43 Jingxian He 2024-08-03 862 void __user *argp = (void __user *)arg; 67e11ee6347c43 Jingxian He 2024-08-03 863 struct virtcca_cvm *cvm = kvm->arch.virtcca_cvm; 67e11ee6347c43 Jingxian He 2024-08-03 864 struct kvm_numa_info *numa_info; 67e11ee6347c43 Jingxian He 2024-08-03 865 befbde867291b5 He Jingxian 2025-04-07 866 if (!kvm_is_realm(kvm)) 67e11ee6347c43 Jingxian He 2024-08-03 867 return -EFAULT; 67e11ee6347c43 Jingxian He 2024-08-03 868 67e11ee6347c43 Jingxian He 2024-08-03 869 if (copy_from_user(&user_data, argp, sizeof(user_data))) 67e11ee6347c43 Jingxian He 2024-08-03 870 return -EINVAL; 67e11ee6347c43 Jingxian He 2024-08-03 871 67e11ee6347c43 Jingxian He 2024-08-03 872 numa_info = &user_data.numa_info; 67e11ee6347c43 Jingxian He 2024-08-03 873 if (numa_info->numa_cnt > MAX_NUMA_NODE) 67e11ee6347c43 Jingxian He 2024-08-03 874 return -EINVAL; 67e11ee6347c43 Jingxian He 2024-08-03 875 67e11ee6347c43 Jingxian He 2024-08-03 876 if (numa_info->numa_cnt > 0) { 67e11ee6347c43 Jingxian He 2024-08-03 877 unsigned long i, total_size = 0; 67e11ee6347c43 Jingxian He 2024-08-03 878 struct kvm_numa_node *numa_node = &numa_info->numa_nodes[0]; 67e11ee6347c43 Jingxian He 2024-08-03 879 unsigned long ipa_end = numa_node->ipa_start + numa_node->ipa_size; 67e11ee6347c43 Jingxian He 2024-08-03 880 67e11ee6347c43 Jingxian He 2024-08-03 881 if (!is_numa_ipa_range_valid(numa_info)) 67e11ee6347c43 Jingxian He 2024-08-03 882 return -EINVAL; 67773feaf93305 gongchangsui 2025-03-04 883 67773feaf93305 gongchangsui 2025-03-04 884 if ((user_data.loader_start != numa_node->ipa_start) || 67773feaf93305 gongchangsui 2025-03-04 885 (user_data.data_start + user_data.data_size < user_data.data_start)) 67e11ee6347c43 Jingxian He 2024-08-03 886 return -EINVAL; 67773feaf93305 gongchangsui 2025-03-04 887 67773feaf93305 gongchangsui 2025-03-04 888 if (is_dtb_info_has_extend_data(user_data.dtb_info)) { 67773feaf93305 gongchangsui 2025-03-04 889 /* Direct boot, check DTB address is in IPA range */ 67773feaf93305 gongchangsui 2025-03-04 890 if (user_data.data_start + user_data.data_size > ipa_end) 67773feaf93305 gongchangsui 2025-03-04 891 return -EINVAL; 67773feaf93305 gongchangsui 2025-03-04 892 } else { 67773feaf93305 gongchangsui 2025-03-04 893 /* 67773feaf93305 gongchangsui 2025-03-04 894 * UEFI boot, check MMIO address range is within the valid limit (less than 67773feaf93305 gongchangsui 2025-03-04 895 * loader_start) 67773feaf93305 gongchangsui 2025-03-04 896 */ 67773feaf93305 gongchangsui 2025-03-04 897 if (user_data.data_start + user_data.data_size > user_data.loader_start) 67773feaf93305 gongchangsui 2025-03-04 898 return -EINVAL; 67773feaf93305 gongchangsui 2025-03-04 899 } 67773feaf93305 gongchangsui 2025-03-04 900 67e11ee6347c43 Jingxian He 2024-08-03 901 for (i = 0; i < numa_info->numa_cnt; i++) 67e11ee6347c43 Jingxian He 2024-08-03 902 total_size += numa_info->numa_nodes[i].ipa_size; 67e11ee6347c43 Jingxian He 2024-08-03 903 if (total_size != user_data.ram_size) 67e11ee6347c43 Jingxian He 2024-08-03 904 return -EINVAL; 67e11ee6347c43 Jingxian He 2024-08-03 905 } 67e11ee6347c43 Jingxian He 2024-08-03 906 67773feaf93305 gongchangsui 2025-03-04 907 if (is_dtb_info_has_extend_data(user_data.dtb_info)) 67773feaf93305 gongchangsui 2025-03-04 908 cvm->dtb_end = user_data.data_start + user_data.data_size; 67773feaf93305 gongchangsui 2025-03-04 909 else { 67773feaf93305 gongchangsui 2025-03-04 910 cvm->dtb_end = user_data.loader_start + user_data.dtb_info; 67773feaf93305 gongchangsui 2025-03-04 911 cvm->mmio_start = user_data.data_start; 67773feaf93305 gongchangsui 2025-03-04 912 cvm->mmio_end = user_data.data_start + user_data.data_size; 67773feaf93305 gongchangsui 2025-03-04 913 } 67e11ee6347c43 Jingxian He 2024-08-03 914 67e11ee6347c43 Jingxian He 2024-08-03 915 cvm->loader_start = user_data.loader_start; 67e11ee6347c43 Jingxian He 2024-08-03 916 cvm->ram_size = user_data.ram_size; 67e11ee6347c43 Jingxian He 2024-08-03 917 memcpy(&cvm->numa_info, numa_info, sizeof(struct kvm_numa_info)); 67e11ee6347c43 Jingxian He 2024-08-03 918 67e11ee6347c43 Jingxian He 2024-08-03 919 return 0; 67e11ee6347c43 Jingxian He 2024-08-03 920 } 67e11ee6347c43 Jingxian He 2024-08-03 921 67e11ee6347c43 Jingxian He 2024-08-03 922 void kvm_cvm_vcpu_put(struct kvm_vcpu *vcpu) 67e11ee6347c43 Jingxian He 2024-08-03 923 { 67e11ee6347c43 Jingxian He 2024-08-03 924 kvm_timer_vcpu_put(vcpu); 67e11ee6347c43 Jingxian He 2024-08-03 925 kvm_vgic_put(vcpu); 67e11ee6347c43 Jingxian He 2024-08-03 926 vcpu->cpu = -1; 67e11ee6347c43 Jingxian He 2024-08-03 927 } 67e11ee6347c43 Jingxian He 2024-08-03 928 67e11ee6347c43 Jingxian He 2024-08-03 929 unsigned long cvm_psci_vcpu_affinity_info(struct kvm_vcpu *vcpu, 67e11ee6347c43 Jingxian He 2024-08-03 930 unsigned long target_affinity, unsigned long lowest_affinity_level) 67e11ee6347c43 Jingxian He 2024-08-03 931 { 67e11ee6347c43 Jingxian He 2024-08-03 932 struct kvm_vcpu *target_vcpu; 67e11ee6347c43 Jingxian He 2024-08-03 933 67e11ee6347c43 Jingxian He 2024-08-03 934 if (lowest_affinity_level != 0) 67e11ee6347c43 Jingxian He 2024-08-03 935 return PSCI_RET_INVALID_PARAMS; 67e11ee6347c43 Jingxian He 2024-08-03 936 67e11ee6347c43 Jingxian He 2024-08-03 937 target_vcpu = kvm_mpidr_to_vcpu(vcpu->kvm, target_affinity); 67e11ee6347c43 Jingxian He 2024-08-03 938 if (!target_vcpu) 67e11ee6347c43 Jingxian He 2024-08-03 939 return PSCI_RET_INVALID_PARAMS; 67e11ee6347c43 Jingxian He 2024-08-03 940 befbde867291b5 He Jingxian 2025-04-07 941 cvm_psci_complete(vcpu, target_vcpu, PSCI_RET_SUCCESS); 67e11ee6347c43 Jingxian He 2024-08-03 942 return PSCI_RET_SUCCESS; 67e11ee6347c43 Jingxian He 2024-08-03 943 } 67e11ee6347c43 Jingxian He 2024-08-03 944 67e11ee6347c43 Jingxian He 2024-08-03 945 int kvm_cvm_vcpu_set_events(struct kvm_vcpu *vcpu, 67e11ee6347c43 Jingxian He 2024-08-03 946 bool serror_pending, bool ext_dabt_pending) 67e11ee6347c43 Jingxian He 2024-08-03 947 { befbde867291b5 He Jingxian 2025-04-07 948 struct tmi_tec_run *run = vcpu->arch.tec.run; 67e11ee6347c43 Jingxian He 2024-08-03 949 if (serror_pending) 67e11ee6347c43 Jingxian He 2024-08-03 950 return -EINVAL; 67e11ee6347c43 Jingxian He 2024-08-03 951 67e11ee6347c43 Jingxian He 2024-08-03 952 if (ext_dabt_pending) { befbde867291b5 He Jingxian 2025-04-07 953 if (!(run->enter.flags & REC_ENTER_FLAG_EMULATED_MMIO)) 67e11ee6347c43 Jingxian He 2024-08-03 954 return -EINVAL; befbde867291b5 He Jingxian 2025-04-07 955 run->enter.flags &= ~REC_ENTER_FLAG_EMULATED_MMIO; befbde867291b5 He Jingxian 2025-04-07 956 run->enter.flags |= REC_ENTER_FLAG_INJECT_SEA; 67e11ee6347c43 Jingxian He 2024-08-03 957 } 67e11ee6347c43 Jingxian He 2024-08-03 958 return 0; 67e11ee6347c43 Jingxian He 2024-08-03 959 } 67e11ee6347c43 Jingxian He 2024-08-03 960 67e11ee6347c43 Jingxian He 2024-08-03 961 int kvm_init_cvm_vm(struct kvm *kvm) 67e11ee6347c43 Jingxian He 2024-08-03 962 { 67e11ee6347c43 Jingxian He 2024-08-03 963 struct tmi_cvm_params *params; 67e11ee6347c43 Jingxian He 2024-08-03 964 struct virtcca_cvm *cvm; 67e11ee6347c43 Jingxian He 2024-08-03 965 67e11ee6347c43 Jingxian He 2024-08-03 966 if (kvm->arch.virtcca_cvm) { 67e11ee6347c43 Jingxian He 2024-08-03 967 kvm_info("cvm already create.\n"); 67e11ee6347c43 Jingxian He 2024-08-03 968 return 0; 67e11ee6347c43 Jingxian He 2024-08-03 969 } 67e11ee6347c43 Jingxian He 2024-08-03 970 67e11ee6347c43 Jingxian He 2024-08-03 971 cvm = (struct virtcca_cvm *)kzalloc(sizeof(struct virtcca_cvm), GFP_KERNEL_ACCOUNT); 67e11ee6347c43 Jingxian He 2024-08-03 972 if (!cvm) 67e11ee6347c43 Jingxian He 2024-08-03 973 return -ENOMEM; 67e11ee6347c43 Jingxian He 2024-08-03 974 67e11ee6347c43 Jingxian He 2024-08-03 975 kvm->arch.virtcca_cvm = cvm; 67e11ee6347c43 Jingxian He 2024-08-03 976 params = kzalloc(PAGE_SIZE, GFP_KERNEL_ACCOUNT); 67e11ee6347c43 Jingxian He 2024-08-03 977 if (!params) { 67e11ee6347c43 Jingxian He 2024-08-03 978 kfree(kvm->arch.virtcca_cvm); 67e11ee6347c43 Jingxian He 2024-08-03 979 kvm->arch.virtcca_cvm = NULL; 67e11ee6347c43 Jingxian He 2024-08-03 980 return -ENOMEM; 67e11ee6347c43 Jingxian He 2024-08-03 981 } 67e11ee6347c43 Jingxian He 2024-08-03 982 67e11ee6347c43 Jingxian He 2024-08-03 983 cvm->params = params; 67e11ee6347c43 Jingxian He 2024-08-03 984 WRITE_ONCE(cvm->state, CVM_STATE_NONE); 67e11ee6347c43 Jingxian He 2024-08-03 985 befbde867291b5 He Jingxian 2025-04-07 986 kvm_enable_virtcca_cvm(kvm); 67e11ee6347c43 Jingxian He 2024-08-03 987 return 0; 67e11ee6347c43 Jingxian He 2024-08-03 988 } a8078c65197c6f yangxiangkai 2024-09-10 989 befbde867291b5 He Jingxian 2025-04-07 990 extern struct vgic_global kvm_vgic_global_state; befbde867291b5 He Jingxian 2025-04-07 991 befbde867291b5 He Jingxian 2025-04-07 @992 u32 kvm_cvm_vgic_nr_lr(void) befbde867291b5 He Jingxian 2025-04-07 993 { befbde867291b5 He Jingxian 2025-04-07 994 return kvm_vgic_global_state.nr_lr; befbde867291b5 He Jingxian 2025-04-07 995 } befbde867291b5 He Jingxian 2025-04-07 996 :::::: The code at line 992 was first introduced by commit :::::: befbde867291b5bb068a97b17086ad20484b6068 VirtCCA: Adapt virtcca operations by cca_base. :::::: TO: He Jingxian <hejingxian(a)huawei.com> :::::: CC: Xu Raoqing <xuraoqing(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
by Yi Yang 23 Sep '25

23 Sep '25

From: Zhang Shurong <zhang_shurong(a)foxmail.com> stable inclusion from stable-v4.19.295 commit adcb73f8ce9aec48b1f85223f401c1574015d8d2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY49I CVE: CVE-2023-53220 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1047f9343011f2cedc73c64829686206a7e9fc3f ] In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach az6007_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Zhang Shurong <zhang_shurong(a)foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/media/usb/dvb-usb-v2/az6007.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c index 746926364535..6bcf30218e51 100644 --- a/drivers/media/usb/dvb-usb-v2/az6007.c +++ b/drivers/media/usb/dvb-usb-v2/az6007.c @@ -795,6 +795,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], if (az6007_xfer_debug) printk(KERN_DEBUG "az6007: I2C W addr=0x%x len=%d\n", addr, msgs[i].len); + if (msgs[i].len < 1) { + ret = -EIO; + goto err; + } req = AZ6007_I2C_WR; index = msgs[i].buf[0]; value = addr | (1 << 8); @@ -809,6 +813,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], if (az6007_xfer_debug) printk(KERN_DEBUG "az6007: I2C R addr=0x%x len=%d\n", addr, msgs[i].len); + if (msgs[i].len < 1) { + ret = -EIO; + goto err; + } req = AZ6007_I2C_RD; index = msgs[i].buf[0]; value = addr; -- 2.25.1

2 1

[openeuler:OLK-6.6 2910/2910] mm/swap.h:66:26: error: implicit declaration of function 'swp_offset'; did you mean 'pud_offset'?
by kernel test robot 23 Sep '25

23 Sep '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: be758a5796c3d280deb877699c41fd0cd04e1deb commit: 5a72d2e54e8ff7c7f9510de875cf201ad18f36c4 [2910/2910] mm/shmem, swap: fix softlockup with mTHP swapin config: x86_64-buildonly-randconfig-002-20250923 (https://download.01.org/0day-ci/archive/20250923/202509231547.ijXKrDIl-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250923/202509231547.ijXKrDIl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509231547.ijXKrDIl-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from mm/shmem.c:43: mm/swap.h: In function 'non_swapcache_batch': >> mm/swap.h:66:26: error: implicit declaration of function 'swp_offset'; did you mean 'pud_offset'? [-Wimplicit-function-declaration] 66 | pgoff_t offset = swp_offset(entry); | ^~~~~~~~~~ | pud_offset In file included from mm/shmem.c:68: include/linux/swapops.h: At top level: >> include/linux/swapops.h:107:23: error: conflicting types for 'swp_offset'; have 'long unsigned int(swp_entry_t)' 107 | static inline pgoff_t swp_offset(swp_entry_t entry) | ^~~~~~~~~~ mm/swap.h:66:26: note: previous implicit declaration of 'swp_offset' with type 'int()' 66 | pgoff_t offset = swp_offset(entry); | ^~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ACPI_HOTPLUG_IGNORE_OSC Depends on [n]: ACPI [=y] && ACPI_HOTPLUG_CPU [=n] Selected by [y]: - X86 [=y] && ACPI [=y] && HOTPLUG_CPU [=y] vim +66 mm/swap.h 62 63 static inline int non_swapcache_batch(swp_entry_t entry, int max_nr) 64 { 65 struct swap_info_struct *si = swp_swap_info(entry); > 66 pgoff_t offset = swp_offset(entry); 67 int i; 68 69 /* 70 * While allocating a large folio and doing mTHP swapin, we need to 71 * ensure all entries are not cached, otherwise, the mTHP folio will 72 * be in conflict with the folio in swap cache. 73 */ 74 for (i = 0; i < max_nr; i++) { 75 if ((si->swap_map[offset + i] & SWAP_HAS_CACHE)) 76 return i; 77 } 78 79 return i; 80 } 81 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] tee: fix NULL pointer dereference in tee_shm_put
by Xiaomeng Zhang 23 Sep '25

23 Sep '25

From: Pei Xiao <xiaopei01(a)kylinos.cn> stable inclusion from stable-v6.6.105 commit add1ecc8f3ad8df22e3599c5c88d7907cc2a3079 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYXVF CVE: CVE-2025-39865 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e4a718a3a47e89805c3be9d46a84de1949a98d5d ] tee_shm_put have NULL pointer dereference: __optee_disable_shm_cache --> shm = reg_pair_to_ptr(...);//shm maybe return NULL tee_shm_free(shm); --> tee_shm_put(shm);//crash Add check in tee_shm_put to fix it. panic log: Unable to handle kernel paging request at virtual address 0000000000100cca Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 [0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- 6.6.0-39-generic #38 Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 10/26/2022 pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tee_shm_put+0x24/0x188 lr : tee_shm_free+0x14/0x28 sp : ffff001f98f9faf0 x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca Call trace: tee_shm_put+0x24/0x188 tee_shm_free+0x14/0x28 __optee_disable_shm_cache+0xa8/0x108 optee_shutdown+0x28/0x38 platform_shutdown+0x28/0x40 device_shutdown+0x144/0x2b0 kernel_power_off+0x3c/0x80 hibernate+0x35c/0x388 state_store+0x64/0x80 kobj_attr_store+0x14/0x28 sysfs_kf_write+0x48/0x60 kernfs_fop_write_iter+0x128/0x1c0 vfs_write+0x270/0x370 ksys_write+0x6c/0x100 __arm64_sys_write+0x20/0x30 invoke_syscall+0x4c/0x120 el0_svc_common.constprop.0+0x44/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x24/0x88 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x14c/0x15 Fixes: dfd0743f1d9e ("tee: handle lookup of shm with reference count 0") Signed-off-by: Pei Xiao <xiaopei01(a)kylinos.cn> Reviewed-by: Sumit Garg <sumit.garg(a)oss.qualcomm.com> Signed-off-by: Jens Wiklander <jens.wiklander(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/tee/tee_shm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 673cf0359494..426b818f2dd7 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -489,9 +489,13 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id); */ void tee_shm_put(struct tee_shm *shm) { - struct tee_device *teedev = shm->ctx->teedev; + struct tee_device *teedev; bool do_release = false; + if (!shm || !shm->ctx || !shm->ctx->teedev) + return; + + teedev = shm->ctx->teedev; mutex_lock(&teedev->mutex); if (refcount_dec_and_test(&shm->refcount)) { /* -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
by Cai Xinchen 23 Sep '25

23 Sep '25

From: Alexander Coffin <alex.coffin(a)matician.com> stable inclusion from stable-v4.19.262 commit d79f4d903e14dde822c60b5fd3bedc5a289d25df category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYQPC CVE: CVE-2022-50408 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3f42faf6db431e04bf942d2ebe3ae88975723478 ] > ret = brcmf_proto_tx_queue_data(drvr, ifp->ifidx, skb); may be schedule, and then complete before the line > ndev->stats.tx_bytes += skb->len; [ 46.912801] ================================================================== [ 46.920552] BUG: KASAN: use-after-free in brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac] [ 46.928673] Read of size 4 at addr ffffff803f5882e8 by task systemd-resolve/328 [ 46.935991] [ 46.937514] CPU: 1 PID: 328 Comm: systemd-resolve Tainted: G O 5.4.199-[REDACTED] #1 [ 46.947255] Hardware name: [REDACTED] [ 46.954568] Call trace: [ 46.957037] dump_backtrace+0x0/0x2b8 [ 46.960719] show_stack+0x24/0x30 [ 46.964052] dump_stack+0x128/0x194 [ 46.967557] print_address_description.isra.0+0x64/0x380 [ 46.972877] __kasan_report+0x1d4/0x240 [ 46.976723] kasan_report+0xc/0x18 [ 46.980138] __asan_report_load4_noabort+0x18/0x20 [ 46.985027] brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac] [ 46.990613] dev_hard_start_xmit+0x1bc/0xda0 [ 46.994894] sch_direct_xmit+0x198/0xd08 [ 46.998827] __qdisc_run+0x37c/0x1dc0 [ 47.002500] __dev_queue_xmit+0x1528/0x21f8 [ 47.006692] dev_queue_xmit+0x24/0x30 [ 47.010366] neigh_resolve_output+0x37c/0x678 [ 47.014734] ip_finish_output2+0x598/0x2458 [ 47.018927] __ip_finish_output+0x300/0x730 [ 47.023118] ip_output+0x2e0/0x430 [ 47.026530] ip_local_out+0x90/0x140 [ 47.030117] igmpv3_sendpack+0x14c/0x228 [ 47.034049] igmpv3_send_cr+0x384/0x6b8 [ 47.037895] igmp_ifc_timer_expire+0x4c/0x118 [ 47.042262] call_timer_fn+0x1cc/0xbe8 [ 47.046021] __run_timers+0x4d8/0xb28 [ 47.049693] run_timer_softirq+0x24/0x40 [ 47.053626] __do_softirq+0x2c0/0x117c [ 47.057387] irq_exit+0x2dc/0x388 [ 47.060715] __handle_domain_irq+0xb4/0x158 [ 47.064908] gic_handle_irq+0x58/0xb0 [ 47.068581] el0_irq_naked+0x50/0x5c [ 47.072162] [ 47.073665] Allocated by task 328: [ 47.077083] save_stack+0x24/0xb0 [ 47.080410] __kasan_kmalloc.isra.0+0xc0/0xe0 [ 47.084776] kasan_slab_alloc+0x14/0x20 [ 47.088622] kmem_cache_alloc+0x15c/0x468 [ 47.092643] __alloc_skb+0xa4/0x498 [ 47.096142] igmpv3_newpack+0x158/0xd78 [ 47.099987] add_grhead+0x210/0x288 [ 47.103485] add_grec+0x6b0/0xb70 [ 47.106811] igmpv3_send_cr+0x2e0/0x6b8 [ 47.110657] igmp_ifc_timer_expire+0x4c/0x118 [ 47.115027] call_timer_fn+0x1cc/0xbe8 [ 47.118785] __run_timers+0x4d8/0xb28 [ 47.122457] run_timer_softirq+0x24/0x40 [ 47.126389] __do_softirq+0x2c0/0x117c [ 47.130142] [ 47.131643] Freed by task 180: [ 47.134712] save_stack+0x24/0xb0 [ 47.138041] __kasan_slab_free+0x108/0x180 [ 47.142146] kasan_slab_free+0x10/0x18 [ 47.145904] slab_free_freelist_hook+0xa4/0x1b0 [ 47.150444] kmem_cache_free+0x8c/0x528 [ 47.154292] kfree_skbmem+0x94/0x108 [ 47.157880] consume_skb+0x10c/0x5a8 [ 47.161466] __dev_kfree_skb_any+0x88/0xa0 [ 47.165598] brcmu_pkt_buf_free_skb+0x44/0x68 [brcmutil] [ 47.171023] brcmf_txfinalize+0xec/0x190 [brcmfmac] [ 47.176016] brcmf_proto_bcdc_txcomplete+0x1c0/0x210 [brcmfmac] [ 47.182056] brcmf_sdio_sendfromq+0x8dc/0x1e80 [brcmfmac] [ 47.187568] brcmf_sdio_dpc+0xb48/0x2108 [brcmfmac] [ 47.192529] brcmf_sdio_dataworker+0xc8/0x238 [brcmfmac] [ 47.197859] process_one_work+0x7fc/0x1a80 [ 47.201965] worker_thread+0x31c/0xc40 [ 47.205726] kthread+0x2d8/0x370 [ 47.208967] ret_from_fork+0x10/0x18 [ 47.212546] [ 47.214051] The buggy address belongs to the object at ffffff803f588280 [ 47.214051] which belongs to the cache skbuff_head_cache of size 208 [ 47.227086] The buggy address is located 104 bytes inside of [ 47.227086] 208-byte region [ffffff803f588280, ffffff803f588350) [ 47.238814] The buggy address belongs to the page: [ 47.243618] page:ffffffff00dd6200 refcount:1 mapcount:0 mapping:ffffff804b6bf800 index:0xffffff803f589900 compound_mapcount: 0 [ 47.255007] flags: 0x10200(slab|head) [ 47.258689] raw: 0000000000010200 ffffffff00dfa980 0000000200000002 ffffff804b6bf800 [ 47.266439] raw: ffffff803f589900 0000000080190018 00000001ffffffff 0000000000000000 [ 47.274180] page dumped because: kasan: bad access detected [ 47.279752] [ 47.281251] Memory state around the buggy address: [ 47.286051] ffffff803f588180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.293277] ffffff803f588200: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 47.300502] >ffffff803f588280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 47.307723] ^ [ 47.314343] ffffff803f588300: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc [ 47.321569] ffffff803f588380: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 47.328789] ================================================================== Signed-off-by: Alexander Coffin <alex.coffin(a)matician.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/20220808174925.3922558-1-alex.coffin@matician.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c index 584e05fdca6a..5de20e5d67b6 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c @@ -270,6 +270,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, struct brcmf_pub *drvr = ifp->drvr; struct ethhdr *eh; int head_delta; + unsigned int tx_bytes = skb->len; brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx); @@ -341,7 +342,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, ndev->stats.tx_dropped++; } else { ndev->stats.tx_packets++; - ndev->stats.tx_bytes += skb->len; + ndev->stats.tx_bytes += tx_bytes; } /* Return ok: we always eat the packet */ -- 2.34.1

2 1

[PATCH OLK-5.10] tee: fix NULL pointer dereference in tee_shm_put
by Xiaomeng Zhang 23 Sep '25

23 Sep '25

From: Pei Xiao <xiaopei01(a)kylinos.cn> stable inclusion from stable-v5.10.243 commit f266188603c34e6e234fb0dfc3185f0ba98d71b7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYXVF CVE: CVE-2025-39865 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e4a718a3a47e89805c3be9d46a84de1949a98d5d ] tee_shm_put have NULL pointer dereference: __optee_disable_shm_cache --> shm = reg_pair_to_ptr(...);//shm maybe return NULL tee_shm_free(shm); --> tee_shm_put(shm);//crash Add check in tee_shm_put to fix it. panic log: Unable to handle kernel paging request at virtual address 0000000000100cca Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 [0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- 6.6.0-39-generic #38 Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 10/26/2022 pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tee_shm_put+0x24/0x188 lr : tee_shm_free+0x14/0x28 sp : ffff001f98f9faf0 x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca Call trace: tee_shm_put+0x24/0x188 tee_shm_free+0x14/0x28 __optee_disable_shm_cache+0xa8/0x108 optee_shutdown+0x28/0x38 platform_shutdown+0x28/0x40 device_shutdown+0x144/0x2b0 kernel_power_off+0x3c/0x80 hibernate+0x35c/0x388 state_store+0x64/0x80 kobj_attr_store+0x14/0x28 sysfs_kf_write+0x48/0x60 kernfs_fop_write_iter+0x128/0x1c0 vfs_write+0x270/0x370 ksys_write+0x6c/0x100 __arm64_sys_write+0x20/0x30 invoke_syscall+0x4c/0x120 el0_svc_common.constprop.0+0x44/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x24/0x88 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x14c/0x15 Fixes: dfd0743f1d9e ("tee: handle lookup of shm with reference count 0") Signed-off-by: Pei Xiao <xiaopei01(a)kylinos.cn> Reviewed-by: Sumit Garg <sumit.garg(a)oss.qualcomm.com> Signed-off-by: Jens Wiklander <jens.wiklander(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/tee/tee_shm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 6fb4400333fb..6d2db6cc247b 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -438,9 +438,13 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id); */ void tee_shm_put(struct tee_shm *shm) { - struct tee_device *teedev = shm->ctx->teedev; + struct tee_device *teedev; bool do_release = false; + if (!shm || !shm->ctx || !shm->ctx->teedev) + return; + + teedev = shm->ctx->teedev; mutex_lock(&teedev->mutex); if (refcount_dec_and_test(&shm->refcount)) { /* -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mmc: vub300: fix return value check of mmc_add_host()
by Yi Yang 23 Sep '25

23 Sep '25

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v4.19.270 commit a46e681151bbdacdf6b89ee8c4e5bad0555142bb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY475 CVE: CVE-2022-50251 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0613ad2401f88bdeae5594c30afe318e93b14676 ] mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(), besides, the timer added before mmc_add_host() needs be del. And this patch fixes another missing call mmc_free_host() if usb_control_msg() fails. Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20221101063023.1664968-9-yangyingliang@huawei.com Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/mmc/host/vub300.c [Commit 99641238575c ("mmc: vub300: fix control-message timeouts") was not merged.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mmc/host/vub300.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c index 1fe68137a30f..12ca9d37f149 100644 --- a/drivers/mmc/host/vub300.c +++ b/drivers/mmc/host/vub300.c @@ -2309,14 +2309,14 @@ static int vub300_probe(struct usb_interface *interface, 0x0000, 0x0000, &vub300->system_port_status, sizeof(vub300->system_port_status), HZ); if (retval < 0) { - goto error4; + goto error5; } else if (sizeof(vub300->system_port_status) == retval) { vub300->card_present = (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0; vub300->read_only = (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0; } else { - goto error4; + goto error5; } usb_set_intfdata(interface, vub300); INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread); @@ -2339,8 +2339,13 @@ static int vub300_probe(struct usb_interface *interface, "USB vub300 remote SDIO host controller[%d]" "connected with no SD/SDIO card inserted\n", interface_to_InterfaceNumber(interface)); - mmc_add_host(mmc); + retval = mmc_add_host(mmc); + if (retval) + goto error6; + return 0; +error6: + del_timer_sync(&vub300->inactivity_timer); error5: mmc_free_host(mmc); /* -- 2.25.1

2 1

[openeuler:OLK-6.6 2909/2909] mm/mem_sampling.c:293:1: sparse: sparse: symbol 'mm_damon_mem_sampling' was not declared. Should it be static?
by kernel test robot 23 Sep '25

23 Sep '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: be758a5796c3d280deb877699c41fd0cd04e1deb commit: 2e9ef6c3ea086c85d489898471e527aeb3f7460b [2909/2909] mm/damon/vaddr: Support hardware-assisted memory access sampling config: arm64-randconfig-r121-20250923 (https://download.01.org/0day-ci/archive/20250923/202509231424.83tDZFT5-lkp@…) compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250923/202509231424.83tDZFT5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509231424.83tDZFT5-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/mem_sampling.c:48:33: sparse: sparse: symbol 'mem_sampling_saved_state' was not declared. Should it be static? mm/mem_sampling.c:61:1: sparse: sparse: symbol 'mem_sampling_record_cb_list' was not declared. Should it be static? mm/mem_sampling.c:69:6: sparse: sparse: symbol 'mem_sampling_record_cb_register' was not declared. Should it be static? mm/mem_sampling.c:86:6: sparse: sparse: symbol 'mem_sampling_record_cb_unregister' was not declared. Should it be static? >> mm/mem_sampling.c:293:1: sparse: sparse: symbol 'mm_damon_mem_sampling' was not declared. Should it be static? vim +/mm_damon_mem_sampling +293 mm/mem_sampling.c 292 > 293 DEFINE_STATIC_KEY_FALSE(mm_damon_mem_sampling); 294 #ifdef CONFIG_DAMON_MEM_SAMPLING 295 static void damon_mem_sampling_record_cb(struct mem_sampling_record *record) 296 { 297 struct damon_mem_sampling_fifo *damon_fifo; 298 struct damon_mem_sampling_record domon_record; 299 struct task_struct *task = NULL; 300 struct mm_struct *mm; 301 302 /* Discard kernel address accesses */ 303 if (record->virt_addr & (1UL << 63)) 304 return; 305 306 task = find_get_task_by_vpid((pid_t)record->context_id); 307 if (!task) 308 return; 309 310 mm = get_task_mm(task); 311 put_task_struct(task); 312 if (!mm) 313 return; 314 315 damon_fifo = mm->damon_fifo; 316 mmput(mm); 317 318 domon_record.vaddr = record->virt_addr; 319 320 /* only the proc under monitor now has damon_fifo */ 321 if (damon_fifo) { 322 if (kfifo_is_full(&damon_fifo->rx_kfifo)) 323 return; 324 325 kfifo_in_locked(&damon_fifo->rx_kfifo, &domon_record, 326 sizeof(struct damon_mem_sampling_record), 327 &damon_fifo->rx_kfifo_lock); 328 return; 329 } 330 } 331 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
by Yi Yang 23 Sep '25

23 Sep '25

From: Zhang Shurong <zhang_shurong(a)foxmail.com> stable inclusion from stable-v4.19.21 commit adcb73f8ce9aec48b1f85223f401c1574015d8d2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY49I CVE: CVE-2023-53220 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1047f9343011f2cedc73c64829686206a7e9fc3f ] In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach az6007_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Zhang Shurong <zhang_shurong(a)foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/media/usb/dvb-usb-v2/az6007.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c index 746926364535..6bcf30218e51 100644 --- a/drivers/media/usb/dvb-usb-v2/az6007.c +++ b/drivers/media/usb/dvb-usb-v2/az6007.c @@ -795,6 +795,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], if (az6007_xfer_debug) printk(KERN_DEBUG "az6007: I2C W addr=0x%x len=%d\n", addr, msgs[i].len); + if (msgs[i].len < 1) { + ret = -EIO; + goto err; + } req = AZ6007_I2C_WR; index = msgs[i].buf[0]; value = addr | (1 << 8); @@ -809,6 +813,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], if (az6007_xfer_debug) printk(KERN_DEBUG "az6007: I2C R addr=0x%x len=%d\n", addr, msgs[i].len); + if (msgs[i].len < 1) { + ret = -EIO; + goto err; + } req = AZ6007_I2C_RD; index = msgs[i].buf[0]; value = addr; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] recordmcount: Fix memory leaks in the uwrite function
by Liu Kai 23 Sep '25

23 Sep '25

From: Hao Zeng <zenghao(a)kylinos.cn> stable inclusion from stable-v4.19.284 commit 444ec005404cead222ebce2561a9451c9ee5ad89 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYBVX CVE: CVE-2023-53318 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fa359d068574d29e7d2f0fdd0ebe4c6a12b5cfb9 ] Common realloc mistake: 'file_append' nulled but not freed upon failure Link: https://lkml.kernel.org/r/20230426010527.703093-1-zenghao@kylinos.cn Signed-off-by: Hao Zeng <zenghao(a)kylinos.cn> Suggested-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- scripts/recordmcount.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c index 4182274a5ab28..ff481b4ae85fa 100644 --- a/scripts/recordmcount.c +++ b/scripts/recordmcount.c @@ -128,6 +128,7 @@ uwrite(int const fd, void const *const buf, size_t const count) { size_t cnt = count; off_t idx = 0; + void *p = NULL; file_updated = 1; @@ -135,7 +136,10 @@ uwrite(int const fd, void const *const buf, size_t const count) off_t aoffset = (file_ptr + count) - file_end; if (aoffset > file_append_size) { - file_append = realloc(file_append, aoffset); + p = realloc(file_append, aoffset); + if (!p) + free(file_append); + file_append = p; file_append_size = aoffset; } if (!file_append) { -- 2.34.1

2 1

[openeuler:OLK-6.6 2909/2909] mm/mem_sampling.c:35:18: warning: unused variable 'mem_sampling_min_value'
by kernel test robot 23 Sep '25

23 Sep '25

Hi Ze, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: be758a5796c3d280deb877699c41fd0cd04e1deb commit: 390982f28c5796a1e590381044630b768e6b9696 [2909/2909] mm/mem_sampling: Add sysctl control for NUMA balancing integration config: arm64-randconfig-r121-20250923 (https://download.01.org/0day-ci/archive/20250923/202509231319.810I86nl-lkp@…) compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250923/202509231319.810I86nl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509231319.810I86nl-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/mem_sampling.c:68:6: warning: no previous prototype for function 'mem_sampling_record_cb_register' [-Wmissing-prototypes] void mem_sampling_record_cb_register(mem_sampling_record_cb_type cb) ^ mm/mem_sampling.c:68:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void mem_sampling_record_cb_register(mem_sampling_record_cb_type cb) ^ static mm/mem_sampling.c:85:6: warning: no previous prototype for function 'mem_sampling_record_cb_unregister' [-Wmissing-prototypes] void mem_sampling_record_cb_unregister(mem_sampling_record_cb_type cb) ^ mm/mem_sampling.c:85:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void mem_sampling_record_cb_unregister(mem_sampling_record_cb_type cb) ^ static >> mm/mem_sampling.c:35:18: warning: unused variable 'mem_sampling_min_value' [-Wunused-const-variable] static const int mem_sampling_min_value = MEM_SAMPLING_MIN_VALUE; ^ >> mm/mem_sampling.c:36:18: warning: unused variable 'mem_sampling_max_value' [-Wunused-const-variable] static const int mem_sampling_max_value = MEM_SAMPLING_MAX_VALUE; ^ 4 warnings generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARM_SPE_MEM_SAMPLING Depends on [n]: ARM_SPE_PMU [=n] Selected by [y]: - MEM_SAMPLING [=y] && ARM64 [=y] vim +/mem_sampling_min_value +35 mm/mem_sampling.c 34 > 35 static const int mem_sampling_min_value = MEM_SAMPLING_MIN_VALUE; > 36 static const int mem_sampling_max_value = MEM_SAMPLING_MAX_VALUE; 37 38 /* keep track of who use the SPE */ 39 DEFINE_PER_CPU(enum arm_spe_user_e, arm_spe_user); 40 EXPORT_PER_CPU_SYMBOL_GPL(arm_spe_user); 41 42 enum mem_sampling_saved_state_e { 43 MEM_SAMPLING_STATE_ENABLE, 44 MEM_SAMPLING_STATE_DISABLE, 45 MEM_SAMPLING_STATE_EMPTY, 46 }; 47 enum mem_sampling_saved_state_e mem_sampling_saved_state = MEM_SAMPLING_STATE_EMPTY; 48 49 /* 50 * Callbacks should be registered using mem_sampling_record_cb_register() 51 * by NUMA, DAMON and etc during their initialisation. 52 * Callbacks will be invoked on new hardware pmu records caputured. 53 */ 54 typedef void (*mem_sampling_record_cb_type)(struct mem_sampling_record *record); 55 56 struct mem_sampling_record_cb_list_entry { 57 struct list_head list; 58 mem_sampling_record_cb_type cb; 59 }; 60 LIST_HEAD(mem_sampling_record_cb_list); 61 62 struct mem_sampling_numa_access_work { 63 struct callback_head work; 64 u64 vaddr, paddr; 65 int cpu; 66 }; 67 68 void mem_sampling_record_cb_register(mem_sampling_record_cb_type cb) 69 { 70 struct mem_sampling_record_cb_list_entry *cb_entry, *tmp; 71 72 list_for_each_entry_safe(cb_entry, tmp, &mem_sampling_record_cb_list, list) { 73 if (cb_entry->cb == cb) 74 return; 75 } 76 77 cb_entry = kmalloc(sizeof(struct mem_sampling_record_cb_list_entry), GFP_KERNEL); 78 if (!cb_entry) 79 return; 80 81 cb_entry->cb = cb; 82 list_add(&(cb_entry->list), &mem_sampling_record_cb_list); 83 } 84 > 85 void mem_sampling_record_cb_unregister(mem_sampling_record_cb_type cb) 86 { 87 struct mem_sampling_record_cb_list_entry *cb_entry, *tmp; 88 89 list_for_each_entry_safe(cb_entry, tmp, &mem_sampling_record_cb_list, list) { 90 if (cb_entry->cb == cb) { 91 list_del(&cb_entry->list); 92 kfree(cb_entry); 93 return; 94 } 95 } 96 } 97 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2909/2909] mm/mem_sampling.c:38:33: sparse: sparse: symbol 'mem_sampling_saved_state' was not declared. Should it be static?
by kernel test robot 23 Sep '25

23 Sep '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: be758a5796c3d280deb877699c41fd0cd04e1deb commit: 02f32cc0235e33f7fc3e4910a80d386bc600935c [2909/2909] mm/mem_sampling:: Add proc and cmdline interface to control sampling enable config: arm64-randconfig-r121-20250923 (https://download.01.org/0day-ci/archive/20250923/202509231143.zSdArtSF-lkp@…) compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250923/202509231143.zSdArtSF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509231143.zSdArtSF-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/mem_sampling.c:38:33: sparse: sparse: symbol 'mem_sampling_saved_state' was not declared. Should it be static? mm/mem_sampling.c:51:1: sparse: sparse: symbol 'mem_sampling_record_cb_list' was not declared. Should it be static? mm/mem_sampling.c:53:6: sparse: sparse: symbol 'mem_sampling_record_cb_register' was not declared. Should it be static? mm/mem_sampling.c:70:6: sparse: sparse: symbol 'mem_sampling_record_cb_unregister' was not declared. Should it be static? mm/mem_sampling.c:83:1: sparse: sparse: symbol 'mem_sampling_access_hints' was not declared. Should it be static? vim +/mem_sampling_saved_state +38 mm/mem_sampling.c 32 33 enum mem_sampling_saved_state_e { 34 MEM_SAMPLING_STATE_ENABLE, 35 MEM_SAMPLING_STATE_DISABLE, 36 MEM_SAMPLING_STATE_EMPTY, 37 }; > 38 enum mem_sampling_saved_state_e mem_sampling_saved_state = MEM_SAMPLING_STATE_EMPTY; 39 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] tee: fix NULL pointer dereference in tee_shm_put
by Xiaomeng Zhang 23 Sep '25

23 Sep '25

From: Pei Xiao <xiaopei01(a)kylinos.cn> mainline inclusion from mainline-v6.17-rc5 commit e4a718a3a47e89805c3be9d46a84de1949a98d5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYXVF CVE: CVE-2025-39865 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- tee_shm_put have NULL pointer dereference: __optee_disable_shm_cache --> shm = reg_pair_to_ptr(...);//shm maybe return NULL tee_shm_free(shm); --> tee_shm_put(shm);//crash Add check in tee_shm_put to fix it. panic log: Unable to handle kernel paging request at virtual address 0000000000100cca Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 [0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- 6.6.0-39-generic #38 Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 10/26/2022 pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tee_shm_put+0x24/0x188 lr : tee_shm_free+0x14/0x28 sp : ffff001f98f9faf0 x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca Call trace: tee_shm_put+0x24/0x188 tee_shm_free+0x14/0x28 __optee_disable_shm_cache+0xa8/0x108 optee_shutdown+0x28/0x38 platform_shutdown+0x28/0x40 device_shutdown+0x144/0x2b0 kernel_power_off+0x3c/0x80 hibernate+0x35c/0x388 state_store+0x64/0x80 kobj_attr_store+0x14/0x28 sysfs_kf_write+0x48/0x60 kernfs_fop_write_iter+0x128/0x1c0 vfs_write+0x270/0x370 ksys_write+0x6c/0x100 __arm64_sys_write+0x20/0x30 invoke_syscall+0x4c/0x120 el0_svc_common.constprop.0+0x44/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x24/0x88 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x14c/0x15 Fixes: dfd0743f1d9e ("tee: handle lookup of shm with reference count 0") Signed-off-by: Pei Xiao <xiaopei01(a)kylinos.cn> Reviewed-by: Sumit Garg <sumit.garg(a)oss.qualcomm.com> Signed-off-by: Jens Wiklander <jens.wiklander(a)linaro.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/tee/tee_shm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index e4c150346a42..b8b306ad4a40 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -433,9 +433,13 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id); */ void tee_shm_put(struct tee_shm *shm) { - struct tee_device *teedev = shm->ctx->teedev; + struct tee_device *teedev; bool do_release = false; + if (!shm || !shm->ctx || !shm->ctx->teedev) + return; + + teedev = shm->ctx->teedev; mutex_lock(&teedev->mutex); if (refcount_dec_and_test(&shm->refcount)) { /* -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] cpufreq: ACPI: Re-sync CPU boost state on system resume
by Lifeng Zheng 23 Sep '25

23 Sep '25

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICZ7F3 ---------------------------------------------------------------------- During CPU hotunplug events (such as those occurring during suspend/resume cycles), platform firmware may modify the CPU boost state. If boost was disabled prior to CPU removal, it correctly remains disabled upon re-plug. However, if firmware re-enables boost while the CPU is offline, the CPU may return with boost enabled—even if it was originally disabled—once it is hotplugged back in. This leads to inconsistent behavior and violates user or kernel policy expectations. To maintain consistency, ensure the boost state is re-synchronized with the kernel policy when a CPU is hotplugged back in. Note: This re-synchronization is not necessary during the initial call to ->init() for a CPU, as the cpufreq core handles it via cpufreq_online(). At that point, acpi_cpufreq_driver.boost_enabled is initialized to the value returned by boost_state(0). Lifeng Zheng (1): cpufreq: ACPI: Re-sync CPU boost state on system resume drivers/cpufreq/acpi-cpufreq.c | 7 +++++++ 1 file changed, 7 insertions(+) -- 2.33.0

2 2

[openeuler:OLK-6.6 2909/2909] mm/mem_sampling.c:35:1: sparse: sparse: symbol 'mem_sampling_record_cb_list' was not declared. Should it be static?
by kernel test robot 23 Sep '25

23 Sep '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a159deb279dfe156316d8c3957dc7f253686ff83 commit: cc5f4f44852f9eb4feb22a40cbb4e3d1b10c36a0 [2909/2909] mm_monitor/mm_spe: Add PMU based memory sampling abstract layer config: arm64-randconfig-r121-20250923 (https://download.01.org/0day-ci/archive/20250923/202509231035.kkQxDq6u-lkp@…) compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250923/202509231035.kkQxDq6u-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509231035.kkQxDq6u-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/mem_sampling.c:35:1: sparse: sparse: symbol 'mem_sampling_record_cb_list' was not declared. Should it be static? >> mm/mem_sampling.c:37:6: sparse: sparse: symbol 'mem_sampling_record_cb_register' was not declared. Should it be static? >> mm/mem_sampling.c:54:6: sparse: sparse: symbol 'mem_sampling_record_cb_unregister' was not declared. Should it be static? mm/mem_sampling.c:67:6: sparse: sparse: symbol 'mem_sampling_process' was not declared. Should it be static? vim +/mem_sampling_record_cb_list +35 mm/mem_sampling.c 30 31 struct mem_sampling_record_cb_list_entry { 32 struct list_head list; 33 mem_sampling_record_cb_type cb; 34 }; > 35 LIST_HEAD(mem_sampling_record_cb_list); 36 > 37 void mem_sampling_record_cb_register(mem_sampling_record_cb_type cb) 38 { 39 struct mem_sampling_record_cb_list_entry *cb_entry, *tmp; 40 41 list_for_each_entry_safe(cb_entry, tmp, &mem_sampling_record_cb_list, list) { 42 if (cb_entry->cb == cb) 43 return; 44 } 45 46 cb_entry = kmalloc(sizeof(struct mem_sampling_record_cb_list_entry), GFP_KERNEL); 47 if (!cb_entry) 48 return; 49 50 cb_entry->cb = cb; 51 list_add(&(cb_entry->list), &mem_sampling_record_cb_list); 52 } 53 > 54 void mem_sampling_record_cb_unregister(mem_sampling_record_cb_type cb) 55 { 56 struct mem_sampling_record_cb_list_entry *cb_entry, *tmp; 57 58 list_for_each_entry_safe(cb_entry, tmp, &mem_sampling_record_cb_list, list) { 59 if (cb_entry->cb == cb) { 60 list_del(&cb_entry->list); 61 kfree(cb_entry); 62 return; 63 } 64 } 65 } 66 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] bpf: Fix memleak due to fentry attach failure
by Pu Lehui 23 Sep '25

23 Sep '25

From: Yafang Shao <laoar.shao(a)gmail.com> mainline inclusion from mainline-v6.5-rc1 commit 108598c39eefbedc9882273ac0df96127a629220 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY4GX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If it fails to attach fentry, the allocated bpf trampoline image will be left in the system. That can be verified by checking /proc/kallsyms. This meamleak can be verified by a simple bpf program as follows: SEC("fentry/trap_init") int fentry_run() { return 0; } It will fail to attach trap_init because this function is freed after kernel init, and then we can find the trampoline image is left in the system by checking /proc/kallsyms. $ tail /proc/kallsyms ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf] ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf] $ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'" [2522] FUNC 'trap_init' type_id=119 linkage=static $ echo $((6442453466 & 0x7fffffff)) 2522 Note that there are two left bpf trampoline images, that is because the libbpf will fallback to raw tracepoint if -EINVAL is returned. Fixes: e21aa341785c ("bpf: Fix fexit trampoline.") Signed-off-by: Yafang Shao <laoar.shao(a)gmail.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Song Liu <song(a)kernel.org> Cc: Jiri Olsa <olsajiri(a)gmail.com> Link: https://lore.kernel.org/bpf/20230515130849.57502-2-laoar.shao@gmail.com Conflicts: kernel/bpf/trampoline.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/trampoline.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c index af9fea93b488..8c0c4cea89c3 100644 --- a/kernel/bpf/trampoline.c +++ b/kernel/bpf/trampoline.c @@ -153,11 +153,8 @@ bpf_trampoline_get_progs(const struct bpf_trampoline *tr, int *total) return tprogs; } -static void __bpf_tramp_image_put_deferred(struct work_struct *work) +static void bpf_tramp_image_free(struct bpf_tramp_image *im) { - struct bpf_tramp_image *im; - - im = container_of(work, struct bpf_tramp_image, work); bpf_image_ksym_del(&im->ksym); bpf_jit_free_exec(im->image); bpf_jit_uncharge_modmem(1); @@ -165,6 +162,14 @@ static void __bpf_tramp_image_put_deferred(struct work_struct *work) kfree_rcu(im, rcu); } +static void __bpf_tramp_image_put_deferred(struct work_struct *work) +{ + struct bpf_tramp_image *im; + + im = container_of(work, struct bpf_tramp_image, work); + bpf_tramp_image_free(im); +} + /* callback, fexit step 3 or fentry step 2 */ static void __bpf_tramp_image_put_rcu(struct rcu_head *rcu) { @@ -319,7 +324,7 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr) &tr->func.model, flags, tprogs, tr->func.addr); if (err < 0) - goto out; + goto out_free; WARN_ON(tr->cur_image && tr->selector == 0); WARN_ON(!tr->cur_image && tr->selector); @@ -330,7 +335,7 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr) /* first time registering */ err = register_fentry(tr, im->image); if (err) - goto out; + goto out_free; if (tr->cur_image) bpf_tramp_image_put(tr->cur_image); tr->cur_image = im; @@ -338,6 +343,10 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr) out: kfree(tprogs); return err; + +out_free: + bpf_tramp_image_free(im); + goto out; } static enum bpf_tramp_prog_type bpf_attach_type_to_tramp(struct bpf_prog *prog) -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] blk-ioinf: introduce inflight-based IO QoS controller
by Baokun Li 23 Sep '25

23 Sep '25

Baokun Li (5): blk-ioinf: introduce inflight-based IO QoS controller blk-ioinf: add inflight/lat interface blk-ioinf: dynamically adjust inflight limit to balance workloads blk-ioinf: support percentile latency QoS for oneline workloads blk-ioinf: support per-online-cgroup weights for priority control block/Kconfig | 10 + block/Makefile | 1 + block/blk-ioinf.c | 1370 ++++++++++++++++++++++++++++++++++++++++ block/blk-mq-debugfs.c | 2 + block/blk-rq-qos.h | 1 + include/linux/blk-mq.h | 3 + 6 files changed, 1387 insertions(+) create mode 100644 block/blk-ioinf.c -- 2.46.1

2 6

[openeuler:OLK-6.6 2909/2909] net/oenetcls/oenetcls_flow.c:140:43: error: no member named 'rx_cpu_rmap' in 'struct net_device'
by kernel test robot 23 Sep '25

23 Sep '25

Hi Wang, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a159deb279dfe156316d8c3957dc7f253686ff83 commit: 22d4075bf5ef29ba4b329f954ac28a7de1d69a65 [2909/2909] net/oenetcls: remove oenetcls trace hook config: x86_64-randconfig-r123-20250923 (https://download.01.org/0day-ci/archive/20250923/202509230929.GGNlyoj3-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250923/202509230929.GGNlyoj3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509230929.GGNlyoj3-lkp@intel.com/ All errors (new ones prefixed by >>): net/oenetcls/oenetcls_flow.c:18:6: warning: no previous prototype for function 'is_oecls_config_netdev' [-Wmissing-prototypes] 18 | bool is_oecls_config_netdev(const char *name) | ^ net/oenetcls/oenetcls_flow.c:18:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 18 | bool is_oecls_config_netdev(const char *name) | ^ | static >> net/oenetcls/oenetcls_flow.c:140:43: error: no member named 'rx_cpu_rmap' in 'struct net_device' 140 | if (!skb_rx_queue_recorded(skb) || !dev->rx_cpu_rmap || | ~~~ ^ >> net/oenetcls/oenetcls_flow.c:161:24: error: no member named 'ndo_rx_flow_steer' in 'struct net_device_ops' 161 | rc = dev->netdev_ops->ndo_rx_flow_steer(dev, skb, rxq_index, flow_id); | ~~~~~~~~~~~~~~~ ^ 1 warning and 2 errors generated. vim +140 net/oenetcls/oenetcls_flow.c 4bed6ba0e88f50 Wang Liang 2025-08-26 17 4bed6ba0e88f50 Wang Liang 2025-08-26 @18 bool is_oecls_config_netdev(const char *name) 4bed6ba0e88f50 Wang Liang 2025-08-26 19 { 4bed6ba0e88f50 Wang Liang 2025-08-26 20 struct oecls_netdev_info *netdev_info; 4bed6ba0e88f50 Wang Liang 2025-08-26 21 int netdev_loop; 4bed6ba0e88f50 Wang Liang 2025-08-26 22 4bed6ba0e88f50 Wang Liang 2025-08-26 23 for_each_oecls_netdev(netdev_loop, netdev_info) 4bed6ba0e88f50 Wang Liang 2025-08-26 24 if (strcmp(netdev_info->dev_name, name) == 0) 4bed6ba0e88f50 Wang Liang 2025-08-26 25 return true; 4bed6ba0e88f50 Wang Liang 2025-08-26 26 4bed6ba0e88f50 Wang Liang 2025-08-26 27 return false; 4bed6ba0e88f50 Wang Liang 2025-08-26 28 } 4bed6ba0e88f50 Wang Liang 2025-08-26 29 22d4075bf5ef29 Wang Liang 2025-09-12 30 static bool _oecls_timeout(struct net_device *dev, u16 rxq_index, 22d4075bf5ef29 Wang Liang 2025-09-12 31 u32 flow_id, u16 filter_id) 4bed6ba0e88f50 Wang Liang 2025-08-26 32 { 4bed6ba0e88f50 Wang Liang 2025-08-26 33 struct netdev_rx_queue *rxqueue = dev->_rx + rxq_index; 4bed6ba0e88f50 Wang Liang 2025-08-26 34 struct oecls_dev_flow_table *flow_table; 4bed6ba0e88f50 Wang Liang 2025-08-26 35 struct oecls_dev_flow *rflow; 4bed6ba0e88f50 Wang Liang 2025-08-26 36 bool expire = true; 4bed6ba0e88f50 Wang Liang 2025-08-26 37 unsigned int cpu; 4bed6ba0e88f50 Wang Liang 2025-08-26 38 4bed6ba0e88f50 Wang Liang 2025-08-26 39 rcu_read_lock(); 4bed6ba0e88f50 Wang Liang 2025-08-26 40 flow_table = rcu_dereference(rxqueue->oecls_ftb); 4bed6ba0e88f50 Wang Liang 2025-08-26 41 if (flow_table && flow_id <= flow_table->mask) { 4bed6ba0e88f50 Wang Liang 2025-08-26 42 rflow = &flow_table->flows[flow_id]; 4bed6ba0e88f50 Wang Liang 2025-08-26 43 cpu = READ_ONCE(rflow->cpu); 4bed6ba0e88f50 Wang Liang 2025-08-26 44 oecls_debug("dev:%s, rxq:%d, flow_id:%u, filter_id:%d/%d, cpu:%d\n", dev->name, 4bed6ba0e88f50 Wang Liang 2025-08-26 45 rxq_index, flow_id, filter_id, rflow->filter, cpu); 4bed6ba0e88f50 Wang Liang 2025-08-26 46 4bed6ba0e88f50 Wang Liang 2025-08-26 47 if (rflow->filter == filter_id && cpu < nr_cpu_ids) { 4bed6ba0e88f50 Wang Liang 2025-08-26 48 if (time_before(jiffies, rflow->timeout + OECLS_TIMEOUT)) { 4bed6ba0e88f50 Wang Liang 2025-08-26 49 expire = false; 4bed6ba0e88f50 Wang Liang 2025-08-26 50 } else { 4bed6ba0e88f50 Wang Liang 2025-08-26 51 rflow->isvalid = 0; 4bed6ba0e88f50 Wang Liang 2025-08-26 52 WRITE_ONCE(rflow->cpu, OECLS_NO_CPU); 4bed6ba0e88f50 Wang Liang 2025-08-26 53 } 4bed6ba0e88f50 Wang Liang 2025-08-26 54 } 4bed6ba0e88f50 Wang Liang 2025-08-26 55 } 4bed6ba0e88f50 Wang Liang 2025-08-26 56 rcu_read_unlock(); 4bed6ba0e88f50 Wang Liang 2025-08-26 57 oecls_debug("%s, dev:%s, rxq:%d, flow_id:%u, filter_id:%d, expire:%d\n", __func__, 4bed6ba0e88f50 Wang Liang 2025-08-26 58 dev->name, rxq_index, flow_id, filter_id, expire); 22d4075bf5ef29 Wang Liang 2025-09-12 59 return expire; 4bed6ba0e88f50 Wang Liang 2025-08-26 60 } 4bed6ba0e88f50 Wang Liang 2025-08-26 61 22d4075bf5ef29 Wang Liang 2025-09-12 62 static void _oecls_flow_update(struct sock *sk) 4bed6ba0e88f50 Wang Liang 2025-08-26 63 { 4bed6ba0e88f50 Wang Liang 2025-08-26 64 struct oecls_sock_flow_table *tb; 4bed6ba0e88f50 Wang Liang 2025-08-26 65 unsigned int hash, index; 4bed6ba0e88f50 Wang Liang 2025-08-26 66 u32 val; 4bed6ba0e88f50 Wang Liang 2025-08-26 67 u32 cpu = raw_smp_processor_id(); 4bed6ba0e88f50 Wang Liang 2025-08-26 68 4bed6ba0e88f50 Wang Liang 2025-08-26 69 if (sk->sk_state != TCP_ESTABLISHED) 4bed6ba0e88f50 Wang Liang 2025-08-26 70 return; 4bed6ba0e88f50 Wang Liang 2025-08-26 71 4bed6ba0e88f50 Wang Liang 2025-08-26 72 if (check_appname(current->comm)) 4bed6ba0e88f50 Wang Liang 2025-08-26 73 return; 4bed6ba0e88f50 Wang Liang 2025-08-26 74 4bed6ba0e88f50 Wang Liang 2025-08-26 75 rcu_read_lock(); 4bed6ba0e88f50 Wang Liang 2025-08-26 76 tb = rcu_dereference(oecls_sock_flow_table); 4bed6ba0e88f50 Wang Liang 2025-08-26 77 hash = READ_ONCE(sk->sk_rxhash); 4bed6ba0e88f50 Wang Liang 2025-08-26 78 if (tb && hash) { 4bed6ba0e88f50 Wang Liang 2025-08-26 79 index = hash & tb->mask; 4bed6ba0e88f50 Wang Liang 2025-08-26 80 val = hash & ~oecls_cpu_mask; 4bed6ba0e88f50 Wang Liang 2025-08-26 81 val |= cpu; 4bed6ba0e88f50 Wang Liang 2025-08-26 82 4bed6ba0e88f50 Wang Liang 2025-08-26 83 if (READ_ONCE(tb->ents[index]) != val) { 4bed6ba0e88f50 Wang Liang 2025-08-26 84 WRITE_ONCE(tb->ents[index], val); 4bed6ba0e88f50 Wang Liang 2025-08-26 85 4bed6ba0e88f50 Wang Liang 2025-08-26 86 oecls_debug("[%s] sk:%p, hash:0x%x, index:0x%x, val:0x%x, cpu:%d\n", 4bed6ba0e88f50 Wang Liang 2025-08-26 87 current->comm, sk, hash, index, val, cpu); 4bed6ba0e88f50 Wang Liang 2025-08-26 88 } 4bed6ba0e88f50 Wang Liang 2025-08-26 89 } 4bed6ba0e88f50 Wang Liang 2025-08-26 90 rcu_read_unlock(); 4bed6ba0e88f50 Wang Liang 2025-08-26 91 } 4bed6ba0e88f50 Wang Liang 2025-08-26 92 4bed6ba0e88f50 Wang Liang 2025-08-26 93 static int flow_get_queue_idx(struct net_device *dev, int nid, struct sk_buff *skb) 4bed6ba0e88f50 Wang Liang 2025-08-26 94 { 4bed6ba0e88f50 Wang Liang 2025-08-26 95 struct oecls_netdev_info *netdev_info; 4bed6ba0e88f50 Wang Liang 2025-08-26 96 int netdev_loop; 4bed6ba0e88f50 Wang Liang 2025-08-26 97 u32 hash, index; 4bed6ba0e88f50 Wang Liang 2025-08-26 98 struct oecls_numa_info *numa_info; 4bed6ba0e88f50 Wang Liang 2025-08-26 99 struct oecls_numa_bound_dev_info *bound_dev = NULL; 4bed6ba0e88f50 Wang Liang 2025-08-26 100 int rxq_id, rxq_num, i; 4bed6ba0e88f50 Wang Liang 2025-08-26 101 4bed6ba0e88f50 Wang Liang 2025-08-26 102 numa_info = get_oecls_numa_info(nid); 4bed6ba0e88f50 Wang Liang 2025-08-26 103 if (!numa_info) 4bed6ba0e88f50 Wang Liang 2025-08-26 104 return -1; 4bed6ba0e88f50 Wang Liang 2025-08-26 105 4bed6ba0e88f50 Wang Liang 2025-08-26 106 for_each_oecls_netdev(netdev_loop, netdev_info) { 4bed6ba0e88f50 Wang Liang 2025-08-26 107 if (strcmp(netdev_info->dev_name, dev->name) == 0) { 4bed6ba0e88f50 Wang Liang 2025-08-26 108 bound_dev = &numa_info->bound_dev[netdev_loop]; 4bed6ba0e88f50 Wang Liang 2025-08-26 109 break; 4bed6ba0e88f50 Wang Liang 2025-08-26 110 } 4bed6ba0e88f50 Wang Liang 2025-08-26 111 } 4bed6ba0e88f50 Wang Liang 2025-08-26 112 4bed6ba0e88f50 Wang Liang 2025-08-26 113 if (!bound_dev) 4bed6ba0e88f50 Wang Liang 2025-08-26 114 return -1; 4bed6ba0e88f50 Wang Liang 2025-08-26 115 rxq_num = bitmap_weight(bound_dev->bitmap_rxq, OECLS_MAX_RXQ_NUM_PER_DEV); 4bed6ba0e88f50 Wang Liang 2025-08-26 116 if (rxq_num == 0) 4bed6ba0e88f50 Wang Liang 2025-08-26 117 return -1; 4bed6ba0e88f50 Wang Liang 2025-08-26 118 4bed6ba0e88f50 Wang Liang 2025-08-26 119 hash = skb_get_hash(skb); 4bed6ba0e88f50 Wang Liang 2025-08-26 120 index = hash % rxq_num; 4bed6ba0e88f50 Wang Liang 2025-08-26 121 4bed6ba0e88f50 Wang Liang 2025-08-26 122 i = 0; 4bed6ba0e88f50 Wang Liang 2025-08-26 123 for_each_set_bit(rxq_id, bound_dev->bitmap_rxq, OECLS_MAX_RXQ_NUM_PER_DEV) 4bed6ba0e88f50 Wang Liang 2025-08-26 124 if (index == i++) 4bed6ba0e88f50 Wang Liang 2025-08-26 125 return rxq_id; 4bed6ba0e88f50 Wang Liang 2025-08-26 126 4bed6ba0e88f50 Wang Liang 2025-08-26 127 return -1; 4bed6ba0e88f50 Wang Liang 2025-08-26 128 } 4bed6ba0e88f50 Wang Liang 2025-08-26 129 4bed6ba0e88f50 Wang Liang 2025-08-26 130 static void set_oecls_cpu(struct net_device *dev, struct sk_buff *skb, 4bed6ba0e88f50 Wang Liang 2025-08-26 131 struct oecls_dev_flow *old_rflow, int old_rxq_id, u16 next_cpu) 4bed6ba0e88f50 Wang Liang 2025-08-26 132 { 4bed6ba0e88f50 Wang Liang 2025-08-26 133 struct netdev_rx_queue *rxqueue; 4bed6ba0e88f50 Wang Liang 2025-08-26 134 struct oecls_dev_flow_table *dtb; 4bed6ba0e88f50 Wang Liang 2025-08-26 135 struct oecls_dev_flow *rflow; 4bed6ba0e88f50 Wang Liang 2025-08-26 136 u32 flow_id, hash; 4bed6ba0e88f50 Wang Liang 2025-08-26 137 u16 rxq_index; 4bed6ba0e88f50 Wang Liang 2025-08-26 138 int rc; 4bed6ba0e88f50 Wang Liang 2025-08-26 139 4bed6ba0e88f50 Wang Liang 2025-08-26 @140 if (!skb_rx_queue_recorded(skb) || !dev->rx_cpu_rmap || 4bed6ba0e88f50 Wang Liang 2025-08-26 141 !(dev->features & NETIF_F_NTUPLE)) 4bed6ba0e88f50 Wang Liang 2025-08-26 142 return; 4bed6ba0e88f50 Wang Liang 2025-08-26 143 4bed6ba0e88f50 Wang Liang 2025-08-26 144 rxq_index = flow_get_queue_idx(dev, cpu_to_node(next_cpu), skb); 4bed6ba0e88f50 Wang Liang 2025-08-26 145 if (rxq_index == skb_get_rx_queue(skb) || rxq_index < 0) 4bed6ba0e88f50 Wang Liang 2025-08-26 146 return; 4bed6ba0e88f50 Wang Liang 2025-08-26 147 4bed6ba0e88f50 Wang Liang 2025-08-26 148 rxqueue = dev->_rx + rxq_index; 4bed6ba0e88f50 Wang Liang 2025-08-26 149 dtb = rcu_dereference(rxqueue->oecls_ftb); 4bed6ba0e88f50 Wang Liang 2025-08-26 150 if (!dtb) 4bed6ba0e88f50 Wang Liang 2025-08-26 151 return; 4bed6ba0e88f50 Wang Liang 2025-08-26 152 4bed6ba0e88f50 Wang Liang 2025-08-26 153 hash = skb_get_hash(skb); 4bed6ba0e88f50 Wang Liang 2025-08-26 154 flow_id = hash & dtb->mask; 4bed6ba0e88f50 Wang Liang 2025-08-26 155 rflow = &dtb->flows[flow_id]; 4bed6ba0e88f50 Wang Liang 2025-08-26 156 if (rflow->isvalid && rflow->cpu == next_cpu) { 4bed6ba0e88f50 Wang Liang 2025-08-26 157 rflow->timeout = jiffies; 4bed6ba0e88f50 Wang Liang 2025-08-26 158 return; 4bed6ba0e88f50 Wang Liang 2025-08-26 159 } 4bed6ba0e88f50 Wang Liang 2025-08-26 160 4bed6ba0e88f50 Wang Liang 2025-08-26 @161 rc = dev->netdev_ops->ndo_rx_flow_steer(dev, skb, rxq_index, flow_id); 4bed6ba0e88f50 Wang Liang 2025-08-26 162 oecls_debug("skb:%p, rxq:%d, hash:0x%x, flow_id:%u, old_rxq_id:%d, next_cpu:%d, rc:%d\n", 4bed6ba0e88f50 Wang Liang 2025-08-26 163 skb, rxq_index, hash, flow_id, old_rxq_id, next_cpu, rc); 4bed6ba0e88f50 Wang Liang 2025-08-26 164 if (rc < 0) 4bed6ba0e88f50 Wang Liang 2025-08-26 165 return; 4bed6ba0e88f50 Wang Liang 2025-08-26 166 4bed6ba0e88f50 Wang Liang 2025-08-26 167 rflow->filter = rc; 4bed6ba0e88f50 Wang Liang 2025-08-26 168 rflow->isvalid = 1; 4bed6ba0e88f50 Wang Liang 2025-08-26 169 rflow->timeout = jiffies; 4bed6ba0e88f50 Wang Liang 2025-08-26 170 if (old_rflow->filter == rflow->filter) 4bed6ba0e88f50 Wang Liang 2025-08-26 171 old_rflow->filter = OECLS_NO_FILTER; 4bed6ba0e88f50 Wang Liang 2025-08-26 172 rflow->cpu = next_cpu; 4bed6ba0e88f50 Wang Liang 2025-08-26 173 } 4bed6ba0e88f50 Wang Liang 2025-08-26 174 :::::: The code at line 140 was first introduced by commit :::::: 4bed6ba0e88f50484fd5fb06bd993727b981b718 net/oenetcls: introduce oenetcls for network optimization :::::: TO: Wang Liang <wangliang74(a)huawei.com> :::::: CC: Wang Liang <wangliang74(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/3] Fix CVE-2022-50255
by Tengda Wu 23 Sep '25

23 Sep '25

This patch series is going to fix CVE-2022-50255. Steven Rostedt (Google) (3): tracing: Move duplicate code of trace_kprobe/eprobe.c into header tracing: Fix reading strings from synthetic events tracing: Have the user copy of synthetic event address use correct context kernel/trace/trace.h | 2 + kernel/trace/trace_events_synth.c | 23 ++++++-- kernel/trace/trace_kprobe.c | 60 ++----------------- kernel/trace/trace_probe_kernel.h | 96 +++++++++++++++++++++++++++++++ 4 files changed, 120 insertions(+), 61 deletions(-) create mode 100644 kernel/trace/trace_probe_kernel.h -- 2.34.1

2 4

[openeuler:OLK-6.6 2909/2909] drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:315:22: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 23 Sep '25

23 Sep '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a159deb279dfe156316d8c3957dc7f253686ff83 commit: ed007ade0cef81fb47328683b8a7eec5edfa8494 [2909/2909] virtcca feature: secure smmu init config: arm64-randconfig-r121-20250923 (https://download.01.org/0day-ci/archive/20250923/202509230956.SzqfHlZe-lkp@…) compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250923/202509230956.SzqfHlZe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509230956.SzqfHlZe-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:315:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] cmd0 @@ got restricted __le64 [usertype] @@ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:315:22: sparse: expected unsigned long long [usertype] cmd0 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:315:22: sparse: got restricted __le64 [usertype] >> drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:316:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] cmd1 @@ got restricted __le64 [usertype] @@ drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:316:22: sparse: expected unsigned long long [usertype] cmd1 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:316:22: sparse: got restricted __le64 [usertype] drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:509:13: sparse: sparse: symbol 'virtcca_smmu_evtq_thread' was not declared. Should it be static? >> drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:527:13: sparse: sparse: symbol 'virtcca_smmu_gerror_handler' was not declared. Should it be static? vim +315 drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c 296 297 /** 298 * Write queue command to TMM 299 * @smmu: An SMMUv3 instance 300 * @src: Command information 301 * @n_dwords: Num of command 302 */ 303 static void virtcca_smmu_queue_write(struct arm_smmu_device *smmu, u64 *src, size_t n_dwords) 304 { 305 u64 cmd0, cmd1; 306 u64 forward = 0; 307 308 if (!is_virtcca_cvm_enable()) 309 return; 310 311 if (!virtcca_smmu_enable(smmu)) 312 return; 313 314 if (n_dwords == ARM_S_SMMU_CMD_COUNT) { > 315 cmd0 = cpu_to_le64(src[0]); > 316 cmd1 = cpu_to_le64(src[1]); 317 virtcca_smmu_cmdq_need_forward(cmd0, cmd1, &forward); 318 319 /* need forward queue command to TMM */ 320 if (forward) { 321 if (tmi_smmu_queue_write(cmd0, cmd1, smmu->s_smmu_id)) 322 dev_err(smmu->dev, "S_SMMU: s queue write failed\n"); 323 } 324 } 325 } 326 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0